Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.

Vite version prior to 4.5.10, 5.0.x prior to 5.4.15, 6.0.x prior to 6.0.12, 6.1.x prior to 6.1.2 or 6.2.x prior to 6.2.3 are affected by a vulnerability allowing unauthenticated remote attackers to read arbitrary files on the affected host when the app is exposing the Vite dev server to the network.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2,
    6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding
    `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists.
    This bypass exists because trailing separators such as `?` are removed in several places, but are not
    accounted for in query string regexes. The contents of arbitrary files can be returned to the browser.
    Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config
    option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue. (CVE-2025-30208)

ID	Name	Product	Family	Severity
114772	Vite < 4.5.10 / 5.0.x < 5.4.15 / 6.0.x < 6.0.12 / 6.1.x < 6.1.2 / 6.2.x < 6.2.3 Arbitrary File Read	Web App Scanning	Component Vulnerability	high
421227	SCA: security update for vite (GHSA-x574-m823-4x7w)	Tenable Cloud Security	SCA Checks	high
421227	SCA: security update for vite (GHSA-x574-m823-4x7w)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-30208

high

Tenable Plugins

high

high

high