⚠ Actively exploited
Added to CISA KEV on 2026-01-22. Federal agencies required to patch by 2026-02-12. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..

CVE-2025-31125 — Sensitive Information Exposure in Vite

CWE-200 — Sensitive Information ExposureCWE-284 — Improper Access ControlCWE-73 — External Control of File Name or Path9 documents9 sources
Severity
7.5HIGHNVD
VulnCheck5.3
EPSS
82.1%
top 0.79%
CISA KEV
KEV
Added 2026-01-22
Due 2026-02-12
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Vitejs Vite
Timeline
PublishedMar 31
KEV addedJan 22
Latest updateJan 23
KEV dueFeb 12
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDvitejs/vite5.0.0 — 5.4.16+4
▶npmvitejs/vite6.2.0 — 6.2.4+4
▶CVEListV5vitejs/vite4 versions+3

Patches

Patch: github.com ↗

🔴Vulnerability Details

3
OSV
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query↗2025-03-31
▶
GHSA
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query↗2025-03-31
▶
VulnCheck
Vite Vitejs Improper Access Control Vulnerability↗2025
▶

💥Exploits & PoCs

1
Nuclei
Vite Development Server - Path Traversal
▶

📋Vendor Advisories

2
CISA
Vite Vitejs Improper Access Control Vulnerability↗2026-01-22
▶
Red Hat
vite: Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query↗2025-03-31
▶

🕵️Threat Intelligence

2
Bleepingcomputer
CISA confirms active exploitation of four enterprise software bugs↗2026-01-23
▶
Recorded Future
January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero-Day↗
▶