CVE-2025-46565

CVE-2025-46565 is a medium-severity vulnerability affecting Vite, a JavaScript frontend tooling framework, specifically versions prior to 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14. It allows an attacker to bypass file matching patterns in the Vite dev server, potentially exposing sensitive files (like .env or certificate files) from the project root to the browser. This vulnerability is exploitable only when the Vite dev server is explicitly exposed to the network. The CVSS score of 5.3 (Medium) indicates a network-based attack with low attack complexity and no required privileges or user interaction, leading to a potential loss of confidentiality. The EPSS score is low, suggesting a minimal probability of exploitation. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules for Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, indicating a low level of public attention.