High severity · published Mar 31, 2025
CVE-2025-31125
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
In wildKEV
7.5
CVSS
65.8%
EPSS
Yes
On KEV
Description
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)65.8% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Jan 22, 2026
Federal remediation dueFeb 12, 2026
Ransomware campaign useNot known
Affected products
Which versions
VI
vite · vitejs
>= 6.2.0, < 6.2.4; >= 6.1.0, < 6.1.3; >= 6.0.0, < 6.0.13; >= 5.0.0, < 5.4.16; < 4.5.11 · source: vendor, NVD
VI
Vitejs · Vite
All versions, or not specified · source: KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2025-31125: Vite Vitejs - Vite Vitejs Improper Access Control Vulnerability
Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
VIVitejsCVE-2025-31125
Jan 22, 2026·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-31125
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-31125
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8
x_refsource_MISC
https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949
More from vite
8.3
CVE-2024-52011
launch-editor vulnerable to command injection via the crafted request on Windows
7.5
CVE-2026-112942
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
7.5
CVE-2026-53571
Vite: `server.fs.deny` bypass on Windows alternate paths
7.5
CVE-2026-39364
Vite has a `server.fs.deny` bypass with queries
7.5
CVE-2026-39363
Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket