CVE-2025-31125: Vite Vitejs Improper Access Control Vulnerability
Summary
The contents of arbitrary files can be returned to the browser.
Impact Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Details
- base64 encoded content of non-allowed files is exposed using ?inline&import (originally reported as ?import&?inline=1.wasm?init) - content of non-allowed files is exposed using ?raw?import
/@fs/ isn't needed to reproduce the issue for files inside the project root.
PoC
Original report (check details above for simplified cases):
The ?import&?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists. Base64 decoding needs to be performed twice $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev
Example full URL http://localhost:5173/@fs/C:/windows/win.ini?import&?inline=1.wasm?init
Other sources
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
— NVD
Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/viteto a version that resolves this vulnerability.Fixed in 4.5.11 - Upgrade
Upgrade
npm/viteto a version that resolves this vulnerability.Fixed in 5.4.16 - Upgrade
Upgrade
npm/viteto a version that resolves this vulnerability.Fixed in 6.0.13 - Upgrade
Upgrade
npm/viteto a version that resolves this vulnerability.Fixed in 6.1.3 - Upgrade
Upgrade
npm/viteto a version that resolves this vulnerability.Fixed in 6.2.4 - Remove
Remove
npm/vitefrom your environment.Discontinue use or uninstall Vite if patches or mitigations cannot be applied.
- Configuration
Do not expose the Vite dev server to the network; avoid running with --host or setting server.host (only bind to local interfaces).
Vite dev server server.host / --host = do not expose to network - Compensating control
Restrict network access to the Vite dev server (firewall, ACLs, or reverse proxy) and apply vendor-recommended mitigations; follow applicable BOD 22-01 guidance for cloud services.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31125?
CVE-2025-31125 is considered a moderate severity vulnerability due to its potential exposure of sensitive files.
How do I fix CVE-2025-31125?
To fix CVE-2025-31125, upgrade to Vite version 6.2.4 or higher, ensuring your development server is not exposed to the network.
Which versions of Vite are affected by CVE-2025-31125?
CVE-2025-31125 affects Vite versions 6.2.4 and below, as well as all earlier versions.
What kind of files can be exposed due to CVE-2025-31125?
CVE-2025-31125 can expose content from non-allowed files when certain query parameters are used.
Who is affected by CVE-2025-31125?
Applications that explicitly expose the Vite development server to the network using the --host option or server.host config are affected by CVE-2025-31125.