CVE-2025-31125
📋 TL;DR
Vite development servers configured to expose content to the network can leak sensitive file contents through specific query parameters (?inline&import or ?raw?import). Only applications explicitly exposing the Vite dev server using --host or server.host configuration are affected by this information disclosure vulnerability.
💻 Affected Systems
- Vite
📦 What is this software?
Vite by Vitejs
Vite by Vitejs
Vite by Vitejs
Vite by Vitejs
Vite by Vitejs
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive configuration files, source code, or credentials stored in the project directory, potentially leading to further compromise.
Likely Case
Unauthorized access to application source code, configuration files, or other project assets that should remain private.
If Mitigated
No impact if Vite dev server is not exposed to untrusted networks or if proper network segmentation is in place.
🎯 Exploit Status
Exploitation requires network access to exposed Vite dev server and knowledge of file paths.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11
Vendor Advisory: https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8
Restart Required: Yes
Instructions:
1. Check current Vite version: npm list vite. 2. Update to patched version: npm update vite@latest or specify exact version. 3. Restart Vite dev server.
🔧 Temporary Workarounds
Disable network exposure
allRemove --host flag or server.host configuration to prevent Vite dev server from being accessible on network
Remove '--host' from dev script in package.json
Remove or comment 'server.host' in vite.config.js
Network segmentation
linuxRestrict access to Vite dev server port using firewall rules
sudo ufw deny 5173/tcp
iptables -A INPUT -p tcp --dport 5173 -j DROP
🧯 If You Can't Patch
- Ensure Vite dev server is not exposed to untrusted networks (remove --host/server.host)
- Implement strict network access controls and firewall rules for Vite dev server port
🔍 How to Verify
Check if Vulnerable:
Check if Vite dev server is running with --host flag or server.host configuration, and version is below patched versionsCheck Version:
npm list vite | grep viteVerify Fix Applied:
Confirm Vite version is 6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual requests to Vite dev server with ?inline&import or ?raw?import parameters
- Access to non-standard file paths
Network Indicators:
- HTTP requests to Vite dev server port (typically 5173) with suspicious query parameters
SIEM Query:
source_port:5173 AND (url_query:*inline* OR url_query:*raw*)🔗 References
- https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949
- https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8
- https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125
