CVE-2025-31125
1 advisory.
npm/vite CVE-2025-31125: medium 5.3, exploited, EPSS 65.19%
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
Action: Upgrade vite to 4.5.11 or later.
npm i vite@6.2.4npm i vite@6.1.3npm i vite@6.0.13npm i vite@5.4.16npm i vite@4.5.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.2.0 | 6.2.4 | - |
| 6.1.0 | 6.1.3 | - |
| 6.0.0 | 6.0.13 | - |
| 5.0.0 | 5.4.16 | - |
| 0 | 4.5.11 | - |
Fixed versions
| 6.2.4 | 6.1.3 | 6.0.13 | 5.4.16 | 4.5.11 |
Sources
- osv: GHSA-4r4m-qw57-chr8
- kev: CVE-2025-31125
- https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8
- https://nvd.nist.gov/vuln/detail/CVE-2025-31125
- https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949
- https://github.com/vitejs/vite
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125
CVE-2025-31125 · published · modified · JSON