CVE-2025-31125
Description
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
Summary dbcve.org
Vite's development server contains a path traversal vulnerability allowing arbitrary file disclosure via specially crafted ?inline&import or ?raw?import query parameters. Only instances explicitly exposed to the network (via --host flag or server.host config) are affected, enabling attackers to read sensitive files on the server.
Mitigation
Upgrade Vite to version 6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11 (depending on your current major version), or ensure the dev server is not exposed to untrusted network connections.