CVE-2025-31486: Vite server.fs.deny bypass via .svg and relative paths

CVE-2025-31486 · Severity: low · CVSS 3.1 · Published 2025-04-04

Vite is a JavaScript build tool widely used by web developers. A vulnerability in its development server allows attackers to bypass file access restrictions (server.fs.deny) and read arbitrary files on the system, such as configuration files or private keys. This only affects developers who explicitly expose the dev server to the network, but could allow an attacker with network access to extract sensitive files smaller than 4KB.

Technologies: Vite. Vendors: Vite.

Quick answers

Is CVE-2025-31486 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-31486 being exploited in the wild.
How severe is CVE-2025-31486?
Low severity, with a CVSS score of 3.1, published 4 April 2025.
Which products and versions are affected?
Vite 0 through 4.5.11, 5.0.0 through 5.4.16, 6.0.0 through 6.0.13, 6.1.0 through 6.1.3, 6.2.0 through 6.2.4.
Is there a fix for CVE-2025-31486?
A patch was published on 2025-04-04: Fixed in versions 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-31486 attacked?
It is attacked over the network.
Am I affected by CVE-2025-31486?
Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an access control bypass (CWE-284/CWE-200) affecting Vite's asset plugin. Two distinct bypasses exist: (1) requests ending in .svg bypass restrictions by appending .wasm?init or sec-fetch-dest: script headers, and (2) relative paths like ../../ bypass the fs.deny check because validation occurs before path normalization. The bypass requires files to be smaller than the build.assetsInlineLimit setting (default 4KB) and only affects Vite 6.0+. An attacker must have network access to the dev server (requires --host or server.host configuration) and can retrieve arbitrary readable files. Patches are available in versions 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.

Affected products

  • Vite Vite 0 through 4.5.11, 5.0.0 through 5.4.16, 6.0.0 through 6.0.13, 6.1.0 through 6.1.3, 6.2.0 through 6.2.4

Identifiers

  • CVE-2025-31486
  • GHSA-xcj6-pq6g-qj4x

Timeline

  • 2025-04-04: disclosed
  • 2025-04-04: patched: Fixed in versions 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.