{"action":"Upgrade vite to 4.5.11 or later.","affected":[{"fixed":"6.2.4","introduced":"6.2.0"},{"fixed":"6.1.3","introduced":"6.1.0"},{"fixed":"6.0.13","introduced":"6.0.0"},{"fixed":"5.4.16","introduced":"5.0.0"},{"fixed":"4.5.11","introduced":"0"}],"component":"vite","cve_ids":["CVE-2025-31125"],"ecosystem":"npm","epss":0.74939,"exploited":true,"fixed_versions":["6.2.4","6.1.3","6.0.13","5.4.16","4.5.11"],"ghsa_id":"GHSA-4r4m-qw57-chr8","id":"tcs_01M5KF19WAQZW21BHDQ1WT442Q","modified_at":"2026-09-10T03:50:56.858424937Z","published_at":"2025-03-31T17:31:54Z","references":["https://osv.dev/vulnerability/GHSA-4r4m-qw57-chr8","https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8","https://nvd.nist.gov/vuln/detail/CVE-2025-31125","https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949","https://github.com/vitejs/vite","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-4r4m-qw57-chr8","url":"https://osv.dev/vulnerability/GHSA-4r4m-qw57-chr8"},{"source":"kev","source_id":"CVE-2025-31125","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query"}