CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2025-03-31
Vite Dev Server File Disclosure and Information Leakage Vulnerability (CVE-2025-31125) Analysis & Mitigation Guide
[Affected Scope] Projects running Vite development server exposed to the network (via --host or server.host configuration) using versions prior to 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11
[Impact] Remote attackers can bypass access restrictions and retrieve sensitive source code or system files by appending crafted query parameters (?inline&import or ?raw?import) to requests
[Mitigation] Immediately upgrade Vite to the patched versions (6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11) and disable unnecessary external host binding (--host)