CVE-2025-31125 — Vite — Fixed in 6.2.4 / 6.1.3 / 6.0.13 / 5.4.16 / 4.5.11

Medium5.3 Published on Mar 31, 2025

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

Fixed versions

Choose the version for your installed product and release branch.

Product	Fixed versions
Vite	6.2.4 / 6.1.3 / 6.0.13 / 5.4.16 / 4.5.11

Versions stated in the NVD description

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Jan 22, 2026
US federal agencies must remediate it by Feb 12, 2026 (BOD 22-01)
First attack observed 59 days after disclosure

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Source: CISA KEV · Sep 11, 2026 Feb 24, 2026 Jan 22, 2026 May 30, 2025

CVSS score5.3 / 10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness type (CWE)CWE-200, CWE-284

Vendorsvitejs

Affected products

Vendors	Product	Versions
vitejs	vite	< 4.5.11

Vulnerabilities

Hackers Scan Exposed Vite Servers for AWS, Azure, and Deployment Secrets

Hackers are scanning exposed Vite dev servers via CVE-2026-39364 to steal AWS keys, Azure tokens, .env files and Terraform state. Learn risks and fixes.

Sep 15, 202601:53 5 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database