CVE-2025-31125
Published: 31 March 2025
Summary
CVE-2025-31125 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Vitejs Vite. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 0.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SC-7 (Boundary Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely patching of affected Vite versions to prevent exposure of non-allowed files via query parameters.
Ensures secure configuration of Vite dev server by prohibiting network exposure options like --host or server.host, eliminating the condition required for exploitation.
Enforces boundary protections to block unauthorized network access to exposed Vite dev server ports, preventing remote attackers from reaching the vulnerable endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables direct retrieval of arbitrary local file contents (sensitive data) from the system via the exposed Vite dev server, mapping to T1005; when the dev server is network-exposed via --host, exploitation of this public-facing application for unauthorized data access maps to T1190.
NVD Description
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is…
more
fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
Deeper analysisAI
CVE-2025-31125 is a vulnerability in Vite, a frontend tooling framework for JavaScript, that exposes the content of non-allowed files via the ?inline?import or ?raw?import query parameters when interacting with the Vite development server. Only applications explicitly exposing the Vite dev server to the network—through the --host command-line option or the server.host configuration—are affected. The issue carries a CVSS v3.1 base score of 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) and maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-284 (Improper Access Control).
A remote attacker with network access to the exposed dev server can exploit this by tricking a user—such as a developer—into loading a crafted URL containing the vulnerable query parameters. Exploitation requires user interaction but no privileges, allowing the attacker to retrieve sensitive file contents from the server, resulting in high confidentiality impact without compromising integrity or availability.
Vite has patched the vulnerability in versions 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11. The official GitHub security advisory (GHSA-4r4m-qw57-chr8) and the fixing commit (59673137c45ac2bcfad1170d954347c1a17ab949) provide full details on the changes.
This CVE appears in the CISA Known Exploited Vulnerabilities Catalog, signaling real-world exploitation activity.
Details
- CWE(s)
- KEV Date Added
- 22 January 2026