| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-6mrd-hwmy-4yay |
| vulnerability_id |
VCID-6mrd-hwmy-4yay |
| summary |
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-31125, GHSA-4r4m-qw57-chr8
|
| risk_score |
10.0 |
| exploitability |
2.0 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6mrd-hwmy-4yay |
|
| 1 |
| url |
VCID-84n3-jwnn-6kc4 |
| vulnerability_id |
VCID-84n3-jwnn-6kc4 |
| summary |
Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-31486, GHSA-xcj6-pq6g-qj4x
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-84n3-jwnn-6kc4 |
|
| 2 |
| url |
VCID-bn49-7c61-27fp |
| vulnerability_id |
VCID-bn49-7c61-27fp |
| summary |
Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-46565, GHSA-859w-5945-r5v3
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bn49-7c61-27fp |
|
| 3 |
| url |
VCID-g8z2-qvuv-b7da |
| vulnerability_id |
VCID-g8z2-qvuv-b7da |
| summary |
Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:npm/vite@6.0.9 |
| purl |
pkg:npm/vite@6.0.9 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-6mrd-hwmy-4yay |
|
| 1 |
| vulnerability |
VCID-84n3-jwnn-6kc4 |
|
| 2 |
| vulnerability |
VCID-bn49-7c61-27fp |
|
| 3 |
| vulnerability |
VCID-h2jq-e6kt-v3f9 |
|
| 4 |
| vulnerability |
VCID-h3c2-mbd1-zua6 |
|
| 5 |
| vulnerability |
VCID-nh6q-ms28-13ee |
|
| 6 |
| vulnerability |
VCID-w4t6-jjc1-afac |
|
| 7 |
| vulnerability |
VCID-xn8m-3ck8-fufm |
|
| 8 |
| vulnerability |
VCID-xrg5-ae14-c3e1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vite@6.0.9 |
|
|
| aliases |
CVE-2025-24010, GHSA-vg6x-rcgg-rjx6
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-g8z2-qvuv-b7da |
|
| 4 |
| url |
VCID-h2jq-e6kt-v3f9 |
| vulnerability_id |
VCID-h2jq-e6kt-v3f9 |
| summary |
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-58752, GHSA-jqfw-vq24-v9c3
|
| risk_score |
1.6 |
| exploitability |
0.5 |
| weighted_severity |
3.3 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-h2jq-e6kt-v3f9 |
|
| 5 |
| url |
VCID-h3c2-mbd1-zua6 |
| vulnerability_id |
VCID-h3c2-mbd1-zua6 |
| summary |
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-58751, GHSA-g4jq-h2w9-997c
|
| risk_score |
1.6 |
| exploitability |
0.5 |
| weighted_severity |
3.3 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-h3c2-mbd1-zua6 |
|
| 6 |
| url |
VCID-nh6q-ms28-13ee |
| vulnerability_id |
VCID-nh6q-ms28-13ee |
| summary |
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-39365, GHSA-4w7w-66w2-5vf9
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nh6q-ms28-13ee |
|
| 7 |
|
| 8 |
|
| 9 |
| url |
VCID-xrg5-ae14-c3e1 |
| vulnerability_id |
VCID-xrg5-ae14-c3e1 |
| summary |
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-30208, GHSA-x574-m823-4x7w
|
| risk_score |
10.0 |
| exploitability |
2.0 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xrg5-ae14-c3e1 |
|
|
|---|