CVE-2025-58752

npm/vite CVE-2025-58752: low

Vite's `server.fs` settings were not applied to HTML files

Action: Upgrade vite to 5.4.20 or later.

npm i vite@7.1.5

npm i vite@7.0.7

npm i vite@6.3.6

npm i vite@5.4.20

Affected

Fixed versions

Sources

• osv: GHSA-jqfw-vq24-v9c3
• https://github.com/vitejs/vite/security/advisories/GHSA-jqfw-vq24-v9c3
• https://nvd.nist.gov/vuln/detail/CVE-2025-58752
• https://github.com/vitejs/vite/commit/0ab19ea9fcb66f544328f442cf6e70f7c0528d5f
• https://github.com/vitejs/vite/commit/14015d794f69accba68798bd0e15135bc51c9c1e
• https://github.com/vitejs/vite/commit/482000f57f56fe6ff2e905305100cfe03043ddea
• https://github.com/vitejs/vite/commit/6f01ff4fe072bcfcd4e2a84811772b818cd51fe6
• https://github.com/vitejs/vite
• https://github.com/vitejs/vite/blob/v7.1.5/packages/vite/CHANGELOG.md

CVE-2025-58752 · published 2025-09-09T20:54:42Z · modified 2026-09-10T03:50:28.597734404Z · JSON