CVE-2025-31125

Description

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

Scoring

• CVSS: 5.3 (MEDIUM, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2026-01-22
• Remediation due date: 2026-02-12
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-200
• CWE-284

References

• https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949
• https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8
• https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125

More from Vite

• No other tracked CVEs for this vendor yet.