CVE-2025-31125 is a critical vulnerability affecting the Vite frontend tooling framework, specifically impacting applications that expose the Vite development server to the network. This flaw allows attackers to expose the content of non-allowed files using specific query parameters, leading to information disclosure. With a CVSS score of 7.5 (HIGH), the vulnerability is easily exploitable over the network without authentication or user interaction, posing a significant risk of sensitive data exposure. Notably, this CVE is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog. While no Metasploit modules or ExploitDB entries exist, Nuclei templates are available, and the vulnerability has garnered substantial community discussion and media coverage, underscoring its high profile and the urgency for patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.5.11CPE matchmatch criteria | cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* | ||
>= 5.0.0, < 5.4.16CPE matchmatch criteria | cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* | ||
>= 6.0.0, < 6.0.13CPE matchmatch criteria | cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* | ||
>= 6.1.0, < 6.1.3CPE matchmatch criteria | cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* | ||
>= 6.2.0, < 6.2.4CPE matchmatch criteria | cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.