CVE-2025-31125

KEVVite Vitejs Improper Access Control Vulnerability

Description

Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

PublishedMar 31, 2025

Last modifiedJun 17, 2026

Added to KEVJan 22, 2026

Remediation dueFeb 12, 2026

References

github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949Patch
github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8ExploitVendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 258 days
CVSS: 5.3 MEDIUM
EPSS (30-day exploit probability): 65.8% · top 1% of all CVEs
Weakness: CWE-200
Attack vector: Network, remotely reachable

Recommended actions

1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.