Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-84n3-jwnn-6kc4
Vulnerability ID VCID-84n3-jwnn-6kc4
Aliases CVE-2025-31486
GHSA-xcj6-pq6g-qj4x
Summary Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-284 Improper Access Control
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-31486.json
epss 0.04736 https://api.first.org/data/v1/epss?cve=CVE-2025-31486
epss 0.04736 https://api.first.org/data/v1/epss?cve=CVE-2025-31486
cvssv3.1 5.3 https://github.com/vitejs/vite
generic_textual MODERATE https://github.com/vitejs/vite
cvssv3.1 5.3 https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
generic_textual MODERATE https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
ssvc Track https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
cvssv3.1 5.3 https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
generic_textual MODERATE https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
ssvc Track https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
cvssv3.1 5.3 https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
generic_textual MODERATE https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
ssvc Track https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2025-31486
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-31486
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-31486.json
https://api.first.org/data/v1/epss?cve=CVE-2025-31486
https://github.com/vitejs/vite
https://nvd.nist.gov/vuln/detail/CVE-2025-31486
2357264 https://bugzilla.redhat.com/show_bug.cgi?id=2357264
62d7e81ee189d65899bb65f3263ddbd85247b647 https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
asset.ts#L285-L290 https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
GHSA-xcj6-pq6g-qj4x https://github.com/advisories/GHSA-xcj6-pq6g-qj4x
GHSA-xcj6-pq6g-qj4x https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-31486.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/vitejs/vite
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-03T20:39:24Z/ Found at https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-03T20:39:24Z/ Found at https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-03T20:39:24Z/ Found at https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-31486
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.89648
EPSS Score 0.04736
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:05:08.163495+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/31xxx/CVE-2025-31486.json 38.6.0