CVE-2025-31125
Published: January 22, 2026
Official Description
Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
CISA KEV Advisory
Vite Vitejs Improper Access Control Vulnerability
Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Risk Analysis
Vite Vitejs has an improper access control vulnerability that can expose the content of non-allowed files when the dev server is explicitly exposed to the network. With a CVSS score of 7.5 and an EPSS score of 0.62361, coupled with its presence in the KEV catalog, this vulnerability presents a significant and confirmed risk, especially for misconfigured deployments.
This vulnerability is actively being exploited in the wild. It is remotely exploitable without authentication or user interaction when the Vite dev server is exposed to the network.
Ensure that the Vite dev server is not exposed to the network unless absolutely necessary, and avoid using --host or server.host config options in production environments. Apply any available patches or updates for Vitejs to address this access control issue.
Technical Analysis
CVE-2025-31125 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.
CISA has added CVE-2025-31125 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-31125 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1