Vulnerability · Published Sep 19, 2025 · Assigned by GitHub_M

CVE-2025-59427Cloudflare vite plugin exposes secrets over the built-in dev server

Low 2.9

In plain English

A low-severity information exposure in workers-sdk from cloudflare. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.9Low

Exploit odds (30 days)0.4%top 67.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as .env and .dev.vars. This vulnerability is fixed in 1.6.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@cloudflare/vite-plugin	1.6.0	GHSA-4pfg-2mw5-f8jx

Affected products (as reported)

Vendor	Product	Versions
cloudflare	workers-sdk	< 1.6.0

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-4pfg-2mw5-f8jx x_refsource_CONFIRM
https://github.com/cloudflare/workers-sdk/commit/0e500720bf70016fa4ea21fc8959c4bd764ebc38 x_refsource_MISC
https://hackerone.com/reports/3117837 x_refsource_MISC
https://github.com/cloudflare/workers-sdk/discussions/3455#discussioncomment-6165773 x_refsource_MISC