CVE-2025-24010: Vite development server CORS and WebSocket origin validation bypass

CVE-2025-24010 · Severity: low · CVSS 3.1 · Published 2025-01-21

Vite is a popular build tool and development server used by web developers to run and test web applications locally. A vulnerability in its default configuration allows any malicious website to send requests to a developer's local Vite server and read the responses—even when the server is not exposed to the network. This could expose application source code, configuration files, and sensitive information being transmitted during development to attackers who trick users into visiting compromised websites.

Technologies: Vite. Vendors: Vite.

Quick answers

Is CVE-2025-24010 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-24010 being exploited in the wild.
How severe is CVE-2025-24010?
Low severity, with a CVSS score of 3.1, published 21 January 2025.
Which products and versions are affected?
Vite >=4.0.0,<=4.5.5; >=5.0.0,<=5.4.11; >=6.0.0,<=6.0.8.
Is there a fix for CVE-2025-24010?
A patch was published on 2025-01-21: Vite 4.5.6, 5.4.12, 6.0.9+ released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-24010 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-24010?
Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from three distinct weaknesses: (1) permissive default CORS headers (Access-Control-Allow-Origin: *) allowing cross-origin fetch requests from any website, (2) lack of Origin header validation on WebSocket connections, enabling Cross-Site WebSocket Hijacking (CSWSH) attacks to intercept HMR (hot module replacement) messages, and (3) missing Host header validation on HTTP requests, facilitating DNS rebinding attacks. An attacker can serve a malicious webpage that, when visited by a developer, executes JavaScript to fetch files from http://127.0.0.1:5173 or establish WebSocket connections, reading source code, error details, and HMR traffic. Affected versions include Vite 4.x ≤4.5.5, 5.0.0–5.4.11, and 6.0.0–6.0.8. Patches are available in 4.5.6+, 5.4.12+, and 6.0.9+.

Affected products

  • Vite Vite >=4.0.0,<=4.5.5; >=5.0.0,<=5.4.11; >=6.0.0,<=6.0.8

Identifiers

  • CVE-2025-24010
  • GHSA-vg6x-rcgg-rjx6

Timeline

  • 2025-01-21: disclosed
  • 2025-01-21: patched: Vite 4.5.6, 5.4.12, 6.0.9+ released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.