CVE-2025-31125
Vite Vitejs Improper Access Control Vulnerability
Description
CVE-2025-31125 is a medium-severity information disclosure vulnerability in Vite, the popular JavaScript frontend build tool. The vulnerability allows an attacker to expose the content of non-allowed files on the development server by using the ?inline&import or ?raw?import query parameters. Only applications that explicitly expose the Vite development server to the network using the --host flag or server.host configuration option are affected. With a CVSS v3.1 base score of 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N), the vulnerability requires high attack complexity and user interaction but delivers high confidentiality impact. It is listed in CISA's KEV catalog with a remediation deadline of February 12, 2026, and has an EPSS score of 0.62361 (98.3rd percentile), which is notably high for a medium-severity vulnerability, indicating significant active exploitation. The vulnerability is fixed in Vite versions 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| vitejs | vite | < 4.5.11; >= 5.0.0, < 5.4.16; >= 6.0.0, < 6.0.13; >= 6.1.0, < 6.1.3; >= 6.2.0, < 6.2.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The primary classification for CVE-2025-31125 is CWE-200, which describes software that exposes sensitive information to actors who are not authorized to access it. In this case, the Vite development server exposes file contents that should be restricted by the server's access control policies through the use of special query parameters (?inline&import or ?raw?import) that bypass the file access restrictions. Learn more about CWE-200
CWE-284: Improper Access Control
The secondary classification is CWE-284, which describes software that does not properly restrict access to resources. The Vite development server implements access controls to prevent serving arbitrary files from the project directory and its parent directories. However, the ?inline&import and ?raw?import query parameters provide an alternate code path that does not enforce these same access restrictions, effectively bypassing the intended file access controls. Learn more about CWE-284
Impact Analysis
Sensitive File Content Disclosure is the primary impact of CVE-2025-31125. An attacker can read the contents of files that the Vite development server would normally deny access to, including configuration files, environment variables, source code, and other project files outside the intended public scope.
Confidentiality Impact is high (C:H). The exposed files can contain highly sensitive information including environment variables with API keys and database credentials (such as .env files), application source code with business logic, configuration files with backend service URLs and authentication tokens, and private keys or certificates stored in the project directory. For development environments, .env files commonly contain production or staging credentials that provide direct access to backend systems.
Integrity Impact is none (I:N). The vulnerability only allows reading file contents and does not provide the ability to modify files on the development server.
Availability Impact is none (A:N). The vulnerability does not affect the availability of the Vite development server or any other system.
Development Environment Risk: While Vite development servers are not typically exposed to the public internet, the prerequisite for exploitation (using --host or server.host) is a common configuration used by developers who need to test on mobile devices, access the server from a local network, or work in containerized environments. The EPSS score of 0.62361 (98.3rd percentile) is remarkably high for a medium-severity vulnerability, suggesting that attackers are actively scanning for and exploiting exposed Vite development servers on internal networks and the internet. CISA lists the ransomware association as "Unknown."
Exploit Maturity
CVE-2025-31125 is confirmed as actively exploited, as evidenced by its inclusion in CISA's KEV catalog with a remediation deadline of February 12, 2026. The EPSS score of 0.62361 (98.3rd percentile) is exceptionally high for a medium-severity development tool vulnerability, indicating significant real-world exploitation.
Public Exploit Availability: The GitHub Security Advisory GHSA-4r4m-qw57-chr8 provides technical details and is tagged as an exploit resource. The exploitation technique is straightforward: an attacker appends ?inline&import or ?raw?import to a file URL on the Vite development server to bypass access restrictions and retrieve the file contents.
Exploitation Simplicity: Exploiting this vulnerability requires only a web browser or curl command. The attacker sends an HTTP request to the Vite development server with the target file path and the bypass query parameters. For example, requesting a normally restricted .env file with the ?raw?import parameter returns the file contents instead of an access denied error. This trivial exploitation technique enables mass scanning and automated exploitation.
Attack Surface Context: Vite is one of the most widely used frontend build tools in the JavaScript ecosystem, powering development workflows for millions of projects. The --host flag is commonly used in development environments, Docker containers, and CI/CD pipelines. Developers frequently expose the Vite server to their local network for cross-device testing, inadvertently creating an attack surface.
Ransomware Association: CISA lists the ransomware association as "Unknown." While a development server information disclosure vulnerability is an unlikely direct vector for ransomware, the exposed credentials (particularly cloud service API keys and database passwords) could provide initial access to production infrastructure that is subsequently targeted with ransomware.
Remediation
-
Update Vite to a patched version immediately. The vulnerability is fixed in Vite 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11. Run
npm update viteoryarn upgrade viteto update to the latest patched version for your major version branch. The patch commit is available for review. -
Stop exposing Vite development servers to the network unless strictly necessary. Remove the --host flag from development scripts and the server.host configuration from vite.config.js if network access is not required. When network access is needed, bind to a specific interface rather than 0.0.0.0 to limit exposure.
-
Rotate all credentials and secrets stored in project files that may have been exposed. This includes API keys, database passwords, OAuth client secrets, and any other credentials in .env files, configuration files, or source code. Assume that any secret accessible from the project directory may have been compromised if the Vite development server was exposed to the network.
-
Implement network-level access controls for development environments. Use firewall rules to restrict access to Vite development server ports to only trusted development machines. In containerized environments, ensure that development server ports are not mapped to host network interfaces unless necessary.
-
Audit development practices across the team to identify other instances where development servers may be unnecessarily exposed. Establish guidelines that development servers should never be accessible from the public internet and should only be exposed to the local network when required for testing purposes.
Technical Details
CVE-2025-31125 is an information disclosure vulnerability in Vite, a JavaScript frontend build tool, that allows bypassing file access restrictions on the development server through specially crafted query parameters.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N yields a score of 5.3. The attack is network-based (AV:N) but has high complexity (AC:H), reflecting that the target Vite server must be explicitly configured for network access. No privileges are required (PR:N), but user interaction is needed (UI:R). The scope is unchanged (S:U), confidentiality impact is high (C:H), while integrity and availability are not affected (I:N/A:N).
Vite File Access Controls: The Vite development server implements file access restrictions that prevent serving files outside the project root and certain sensitive files within it (such as .env files). These restrictions are enforced when a client requests a file through the normal request path. The server checks the resolved file path against an allowed list before serving the content.
Bypass Mechanism: The ?inline&import and ?raw?import query parameters instruct Vite to process a file through its module transformation pipeline rather than serving it as a static file. The inline import mechanism is designed to embed file contents directly into JavaScript modules, while the raw import mechanism returns the file contents as a string export. Both mechanisms follow a different code path than static file serving, and critically, this alternate code path does not enforce the same file access restrictions. As a result, files that would be denied through a normal request are accessible when requested with these query parameters.
Prerequisites: The vulnerability only affects Vite development servers that are explicitly configured to listen on a network interface accessible to the attacker. By default, Vite binds only to localhost (127.0.0.1), which limits access to the local machine. The --host CLI flag or server.host configuration option must be used to bind the server to 0.0.0.0 or a specific network interface. This is a common configuration for cross-device testing, Docker development environments, and remote development setups.
Affected Versions: The vulnerability affects all Vite versions prior to 4.5.11, versions 5.0.0 through 5.4.15, versions 6.0.0 through 6.0.12, versions 6.1.0 through 6.1.2, and versions 6.2.0 through 6.2.3. The wide range of affected versions reflects that this bypass existed across the entire Vite 4.x through 6.x release line.
Frequently Asked Questions
What is CVE-2025-31125?
CVE-2025-31125 is an information disclosure vulnerability in the Vite JavaScript build tool that allows attackers to read restricted files from the development server by using ?inline&import or ?raw?import query parameters. It affects Vite versions prior to 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11, but only when the server is configured to listen on a network interface (--host flag).
Am I affected if I use Vite only for local development?
If you run vite or vite dev without the --host flag and without setting server.host in your configuration, your development server binds only to localhost and is not accessible from the network. In this default configuration, the vulnerability cannot be exploited by external attackers. However, updating is still recommended to protect against any scenario where the server might be exposed.
What kind of data can be exposed?
An attacker can potentially read any file within the project directory, including .env files containing API keys and database credentials, application source code, configuration files, and any other project files. The most critical exposure is typically .env files, which commonly contain secrets for cloud services, databases, and third-party APIs.
Why does a medium-severity vulnerability have such a high EPSS score?
The EPSS score of 0.62361 (98.3rd percentile) reflects the massive number of Vite development servers exposed on networks and the trivial nature of exploitation. While the CVSS score is medium because it requires the --host configuration and user interaction, the widespread use of Vite and the commonality of the --host flag in containerized environments means that many instances are exploitable in practice.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.