CVE-2025-31125

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-284

Affected software

Vendor	Product	Versions
vitejs	vite	>= 6.2.0, < 6.2.4; >= 6.1.0, < 6.1.3; >= 6.0.0, < 6.0.13; >= 5.0.0, < 5.4.16; < 4.5.11

References

https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949Patch
https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8Exploit, Vendor Advisory
https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8Exploit, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125US Government Resource

Timeline

Published: Mar 31, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 22, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-311265.3Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the CVE-2025-311275.3Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in CVE-2025-311286.9gifplayer is a customizable jquery plugin to play and stop animated gifs. gifplayer contains a cross-site scripting (XSS) vulnerability. Thi CVE-2025-311298.8Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. Thi CVE-2025-31139.0A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leve CVE-2025-311306.8gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detectio CVE-2025-311317.5YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary CVE-2025-311328.1Raven is an open-source messaging platform. A vulnerability allowed any logged in user to execute code via an API endpoint. This vulnerabili CVE-2025-311337.8runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1 CVE-2025-311347.5FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by chec CVE-2025-311355.3Go-Guerrilla SMTP Daemon is a lightweight SMTP server written in Go. Prior to 1.6.7, when ProxyOn is enabled, the PROXY command will be acce CVE-2025-311365.4FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This oc