CVE-2025-31125

Vite tries to keep certain files hidden from the browser (for example, files outside allowed folders). This bug is like a “guardrail” that can be bypassed using a specially crafted link that convinces someone to open it, which can cause Vite to show files it was told to deny. The risk is mainly for teams that run a Vite dev server that’s reachable from other machines over the network.

This matters if you run the Vite development server in a way that’s reachable from outside your internal network (for example, using --host or server.host). If the dev server is not exposed, the attack path won’t be reachable. If it is exposed, an attacker still needs a user to open a crafted link to trigger the file disclosure.

This is RED because CISA has added CVE-2025-31125 to its KEV list and it has real-world reported activity tied to this issue. Attackers are actively looking for ways to make Vite reveal blocked files, which is most feasible when the dev server is reachable on the network. Fixing is time-critical.

Confirm exposure (quick checks)

• Identify where Vite dev server is run (CI preview environments, internal demos, staging that’s internet-reachable, or developer machines exposed to the network).
• Verify configuration and runtime flags:
  • Look for --host usage when starting Vite.
  • Look for server.host set in your Vite config or environment variables.
• Network check:
  • Confirm whether the Vite dev server URL/port is reachable from the internet or from untrusted networks. If yes, treat as affected.

Confirm version

• Check your installed Vite version (from package.json and your lockfile).
• If you’re using a monorepo, check each package that depends on Vite.

Patch/upgrade (fixed versions)

Upgrade Vite to one of the fixed versions:

• 6.2.4
• 6.1.3
• 6.0.13
• 5.4.16
• 4.5.11

If you’re on an older major, upgrade within the supported range listed above (the advisory provides multiple fixed branches). After upgrading, redeploy the environment where the Vite dev server is exposed.

If you cannot patch immediately (mitigation)

• Stop exposing the Vite dev server externally. Only keep it accessible from trusted internal networks.
• If you use a reverse proxy or firewall, add strict allowlisting so only your team can reach the Vite dev server.

KEV timing

• CISA remediation due date: 2026-02-12 (from the KEV listing).

What to monitor

• Web server access logs for unusual requests to the dev server that contain query parameters consistent with the reported bypass behavior.
• Unusual file access patterns in any logs associated with your dev server or reverse proxy.

Retest

• After the upgrade and network restriction, verify that the same external URLs that previously worked (if any) no longer return denied file contents.

CVE-2025-31125 is a medium-severity issue (CVSS 5.3) in Vite that enables read access to files that should be blocked by server.fs.deny. The mechanism is a bypass for denied filesystem paths when serving inline and raw content using the ?import query flow.

Attack prerequisites from the findings:

• No prior authentication required.
• User interaction is required (a victim must open a crafted link).
• The Vite dev server must be explicitly exposed to the network (for example with --host or server.host), otherwise the attacker can’t reach the vulnerable endpoint.

Exploitation status:

• CISA KEV includes this vulnerability (added 2026-01-22) with a remediation due date of 2026-02-12, indicating confirmed real-world relevance.
• There is at least one public PoC.

Patch status:

• Fixed in Vite 6.2.4 and also backported fixes exist for 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

Note on EPSS:

• A prediction exists, but the KEV listing is the controlling signal for urgency; this response does not rely on the prediction for decision-making.