CVE-2025-31125: Vite server.fs.deny bypass with inline and raw query parameters

CVE-2025-31125 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2025-03-31

Vite, a popular frontend build tool and development server, contains an access control weakness that allows attackers to read arbitrary files from the server when the dev server is exposed to the network. An attacker can use specially crafted query parameters (?inline&import or ?raw?import) to bypass file access restrictions and retrieve sensitive file contents. This affects only development setups that explicitly expose the Vite dev server externally (via --host or server.host config).

Technologies: Vite. Vendors: Vite.

Quick answers

Is CVE-2025-31125 exploited in the wild?
Yes. CVE-2025-31125 is known to be exploited in the wild, first recorded on 22 January 2026. Treat it as urgent.
How severe is CVE-2025-31125?
Critical severity, with a CVSS score of 3.1, published 31 March 2025.
Which products and versions are affected?
Vite < 4.5.11, >= 5.0.0 and < 5.4.16, >= 6.0.0 and < 6.0.13, >= 6.1.0 and < 6.1.3, >= 6.2.0 and < 6.2.4.
Is there a fix for CVE-2025-31125?
A patch was published on 2025-03-31: Fix committed and patches released across all affected versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-31125 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-31125?
Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a CWE-200 (Exposure of Sensitive Information) / CWE-284 (Improper Access Control) issue in Vite's transform middleware. The dev server's file system access checks (server.fs.deny) are bypassed when processing inline or raw query parameters combined with import directives. An attacker network-adjacent to an exposed dev server can craft malicious URLs (e.g., http://localhost:5173/@fs/C:/windows/win.ini?import&?inline=1.wasm?init) to retrieve base64-encoded file contents from the filesystem, including files outside the project root. User interaction is required to trigger the request (e.g., visiting a malicious link), but no authentication is necessary. The fix was committed to Vite's main repository on 2025-03-31 and has been released in patched versions across all affected release lines (4.5.11+, 5.4.16+, 6.0.13+, 6.1.3+, 6.2.4+).

Affected products

  • Vitejs Vite < 4.5.11, >= 5.0.0 and < 5.4.16, >= 6.0.0 and < 6.0.13, >= 6.1.0 and < 6.1.3, >= 6.2.0 and < 6.2.4

Identifiers

  • CVE-2025-31125
  • GHSA-4r4m-qw57-chr8

Timeline

  • 2025-03-31: disclosed: Advisory published
  • 2025-03-31: patched: Fix committed and patches released across all affected versions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.