Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

Vite version prior to 4.5.11, 5.0.x prior to 5.4.16, 6.0.x prior to 6.0.13, 6.1.x prior to 6.1.3 or 6.2.x prior to 6.2.4 are affected by a vulnerability allowing unauthenticated remote attackers to read arbitrary files on the affected host when the app is exposing the Vite dev server to the network.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using
    ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using
    --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13,
    5.4.16, and 4.5.11. (CVE-2025-31125)

ID	Name	Product	Family	Severity
115120	Vite < 4.5.11 / 5.0.x < 5.4.16 / 6.0.x < 6.0.13 / 6.1.x < 6.1.3 / 6.2.x < 6.2.4 Arbitrary File Read	Web App Scanning	Component Vulnerability	medium
423584	SCA: security update for vite (GHSA-4r4m-qw57-chr8)	Tenable Cloud Security	SCA Checks	high
423584	SCA: security update for vite (GHSA-4r4m-qw57-chr8)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-31125

high

Tenable Plugins

medium

high

high