Log in Start free

Vulnerability · Published Sep 8, 2025 · Assigned by GitHub_M

CVE-2025-58752Vite's `server.fs` settings were not applied to HTML files

Low 2.3

In plain English

A low-severity information exposure in vite from vitejs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.3Low
Exploit odds (30 days)0.6%top 50.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmvite7.1.5GHSA-jqfw-vq24-v9c3
npmvite7.0.7GHSA-jqfw-vq24-v9c3
npmvite6.3.6GHSA-jqfw-vq24-v9c3
npmvite5.4.20GHSA-jqfw-vq24-v9c3

Affected products (as reported)

VendorProductVersions
vitejs vite < 5.4.20>= 6.0.0, < 6.3.6>= 7.0.0, < 7.0.7>= 7.1.0, < 7.1.5

Weakness: CWE-23, CWE-200, CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References