CVE-2025-31125: Vite Vitejs Improper Access Control Vulnerability
Vulnerability summary
CVE-2025-31125 is a high (CVSS 7.5) vulnerability in Vite Vitejs. It is known to be exploited: CISA lists it, first on 22-01-2026. EPSS estimates a 65.19% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 5Timeline
- 31-03-2025PublishedVulnerability first disclosed.
- 22-01-2026Added to CISA KEVVite Vitejs Improper Access Control Vulnerability
- 23-01-2026Last modifiedVulnerability information updated.
- 12-02-2026CISA remediation dueApply mitigations per vendor instructions.
Description
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NDiffers
- OSV · NpmEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
65.19%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
+6.73 pp
From 58.46% on 20-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 22-01-2026
- Federal due date
- 12-02-2026
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. nvd.nist.gov/vuln/detail/CVE-2025-31125
Public exploits
1 foundVite
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affected systems
Chainguard2 products
- langfuse-2-worker< 2.95.12-r26
- langfuse-fips-2-worker< 2.95.12-r28
Npm1 product
- vite≥ 6.2.0, < 6.2.4 | ≥ 6.1.0, < 6.1.3 | ≥ 6.0.0, < 6.0.13 | ≥ 5.0.0, < 5.4.16 | < 4.5.11
Vitejs1 product
- vite< 4.5.11 | ≥ 5.0.0, < 5.4.16 | ≥ 6.0.0, < 6.0.13 | ≥ 6.1.0, < 6.1.3 | ≥ 6.2.0, < 6.2.4
3 vendors · 4 products
References
6 links- github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8X Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125Government ResourceWEBUS Government Resource
- github.com/vitejs/vitePACKAGE