CVE-2025-31125

Description

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: MEDIUM
CVSS score: 5.3 / 10
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Effective score: 5.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-200, CWE-284
Reserved: 2025-03-26
Published: 2025-03-31 19:06 UTC
Last updated: 2026-01-23 17:58 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json

CISA Known Exploited Vulnerabilities CISA KEV

CISA has confirmed in-the-wild exploitation of this CVE. Federal agencies must remediate by the due date below; private orgs should treat it as priority-1.

Vulnerability name: Vite Vitejs Improper Access Control Vulnerability
Vendor / project: Vite
Product: Vitejs
Date added to KEV: 2026-01-22
Remediation due: 2026-02-12
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaign use: Unknown
CISA notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949 ; https://nvd.nist.gov/vuln/detail/CVE-2025-31125
CISA listing: www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2025-03-31 17:15:43 UTC
NVD last modified: 2026-06-17 09:09:54 UTC
NVD CVSS v3.1: 5.3 / 10 MEDIUM source: security-advisories@github.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Exploitability subscore: 1.6 / 10
Impact subscore: 3.6 / 10
EPSS score: 0.6210 (probability of exploitation in next 30 days)
EPSS percentile: 99.07% vs all CVEs — higher = more likely to be exploited, as of 2026-06-29

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2025-8866
Assigner: GitHub_M
Published: Mar 31, 2025, 5:06:30 PM
Updated: Jan 23, 2026, 4:58:37 PM
EUVD base score (CVSS 3.1): 5.3 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
EUVD-reported EPSS: 83.2400
Vendors: vitejs
Products: vite (6.0.0, < 6.0.13)

vite (6.1.0, < 6.1.3)

vite (6.2.0, < 6.2.4)

vite (< 4.5.11)

vite (5.0.0, < 5.4.16)
Aliases: GHSA-4r4m-qw57-chr8

ENISA description: Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

EUVD references (2)

Affected products (1)

Vendor	Product	Versions	Platforms
vitejs	vite	`>= 6.2.0, < 6.2.4` (affected), `>= 6.1.0, < 6.1.3` (affected), `>= 6.0.0, < 6.0.13` (affected), `>= 5.0.0, < 5.4.16` (affected), `< 4.5.11` (affected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8 x_refsource_CONFIRM
https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949 x_refsource_MISC

MITRE references (2) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949 x_refsource_MISC
https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8 x_refsource_CONFIRM

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949 security-advisories@github.com Patch
https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8 security-advisories@github.com ExploitVendor Advisory
https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8 134c704f-9b21-4f2e-91b3-4a467353bcc0 ExploitVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125 134c704f-9b21-4f2e-91b3-4a467353bcc0 US Government Resource

Remediations (10)

Microsoft December 2025 Patch Tuesday - 56 Vulnerabilities Fixed ...

web:cybersecuritynews.com

Microsoft released its final Patch Tuesday updates of 2025 on December 9, addressing 56 security vulnerabilities across Windows, Office, Exchange Server, and other components.

2026-05-23 14:13 UTC
Microsoft Patch Tuesday, September 2025 Edition - Krebs on Security

web:krebsonsecurity.com

Microsoft Corp. today issued security updates to fix more than 80 vulnerabilities in its Windows operating systems and software. There are no known "zero-day" or actively exploited vulnerabilities ...

2026-05-23 14:13 UTC
Microsoft December 2025 Security Updates / FYI - Microsoft Q&A

web:learn.microsoft.com

Microsoft December 2025 Security Updates This release consists of the following 57 Microsoft CVEs : Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations ? Windows PowerShell CVE - 2025 -54100 Windows Projected File System…

2026-05-23 14:13 UTC
Microsoft December 2025 Patch Tuesday fixes 3 zero-days, 57 flaws

web:www.bleepingcomputer.com

Microsoft's December 2025 Patch Tuesday fixes 57 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

2026-05-23 14:13 UTC
CVE Record: CVE-2025-31125

web:www.cve.org

Vulnerability detail for CVE-2025-31125 Notice: Expanded keyword searching of CVE Records (with limitations) is now available in the search box above. Learn more here.

2026-05-23 14:13 UTC
Microsoft Patch Tuesday - October 2025 - Lansweeper

web:www.lansweeper.com

The October 2025 edition of Patch Tuesday brings us 173 new fixes, with 9 rated as critical, 3 of which are actively exploited. We've listed the most important changes below. Windows Agere Modem Driver Elevation of Privilege Vulnerability CVE - 2025 -24990 is an elevation of privilege vulnerability that has been actively exploited.

2026-05-23 14:13 UTC
Microsoft KB Catalog: Updates, Issues, & Feedback - NinjaOne

web:www.ninjaone.com

Catalog of Microsoft KB updates with insights on performance & user sentiment. Find out what's working, what's not, & make informed decisions.

2026-05-23 14:13 UTC
November 2025 Third-Party Vulnerabilities and Patches - Recast

web:www.recastsoftware.com

Overall, it was a quieter period for remediation , with fewer issues and fewer patches compared to October. Notable Vulnerabilities in November 2025 Third-Party Patches Once again, we have a chromium-based vulnerability CVE - 2025 -13223 affecting multiple browsers. This vulnerability is actively exploited, and it has been confirmed by Google and CISA.

2026-05-23 14:13 UTC
Patch Tuesday Megathread (2025-12-09) : r/sysadmin - Reddit

web:www.reddit.com

Patch Tuesday Megathread ( 2025 -12-09) Hello r/sysadmin, I'm u/AutoModerator, and welcome to this month's Patch Megathread! This is the (mostly) safe location to talk about the latest patches, updates, and releases.

2026-05-23 14:13 UTC
Patch Tuesday 2025 Year In Review | Tenable®

web:www.tenable.com

Key takeaways: Microsoft's 2025 Patch Tuesday releases addressed 1,130 CVEs . This is the second year in a row where the CVE count was over 1,000. Elevation of Privilege vulnerabilities accounted for 38.3% of all Patch Tuesday vulnerabilities in 2025 , followed by Remote Code Execution flaws at 30.8%. 41 zero-day vulnerabilities were addressed across all Patch Tuesday releases in 2025 , including ...

2026-05-23 14:13 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2025-31125.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-31125",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-23T16:58:33.096334Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-01-22",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-23T16:58:37.048Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vite",
          "vendor": "vitejs",
          "versions": [
            {
              "status": "affected",
              "version": ">= 6.2.0, < 6.2.4"
            },
            {
              "status": "affected",
              "version": ">= 6.1.0, < 6.1.3"
            },
            {
              "status": "affected",
              "version": ">= 6.0.0, < 6.0.13"
            },
            {
              "status": "affected",
              "version": ">= 5.0.0, < 5.4.16"
            },
            {
              "status": "affected",
              "version": "< 4.5.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-31T17:31:51.583Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8"
        },
        {
          "name": "https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949"
        }
      ],
      "source": {
        "advisory": "GHSA-4r4m-qw57-chr8",
        "discovery": "UNKNOWN"
      },
      "title": "Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-31125",
    "datePublished": "2025-03-31T17:06:30.704Z",
    "dateReserved": "2025-03-26T15:04:52.626Z",
    "dateUpdated": "2026-01-23T16:58:37.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}