CVE-2025-31486

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x

Configurations

No configuration.

History

07 Apr 2025, 14:18

Type	Values Removed	Values Added
Summary		(es) Vite es un framework de herramientas frontend para JavaScript. El contenido de archivos arbitrarios se puede devolver al navegador. Al añadir ?.svg con ?.wasm?init o con el encabezado de script sec-fetch-dest:, se pudo omitir la restricción server.fs.deny. Esta omisión solo es posible si el archivo es menor que build.assetsInlineLimit (valor predeterminado: 4 KB) y al usar Vite 6.0 o posterior. Solo se ven afectadas las aplicaciones que exponen explícitamente el servidor de desarrollo de Vite a la red (mediante la opción de configuración --host o server.host). Esta vulnerabilidad se corrigió en las versiones 4.5.12, 5.4.17, 6.0.14, 6.1.4 y 6.2.5.

03 Apr 2025, 21:15

Type	Values Removed	Values Added
References	~~() https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x -~~	() https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x -

03 Apr 2025, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-03 19:15

Updated : 2025-04-07 14:18

NVD link : CVE-2025-31486

Mitre link : CVE-2025-31486

CVE.ORG link : CVE-2025-31486

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-284

Improper Access Control

{"id": "CVE-2025-31486", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "published": "2025-04-03T19:15:39.890", "references": [{"url": "https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5."}, {"lang": "es", "value": "Vite es un framework de herramientas frontend para JavaScript. El contenido de archivos arbitrarios se puede devolver al navegador. Al a\u00f1adir ?.svg con ?.wasm?init o con el encabezado de script sec-fetch-dest:, se pudo omitir la restricci\u00f3n server.fs.deny. Esta omisi\u00f3n solo es posible si el archivo es menor que build.assetsInlineLimit (valor predeterminado: 4 KB) y al usar Vite 6.0 o posterior. Solo se ven afectadas las aplicaciones que exponen expl\u00edcitamente el servidor de desarrollo de Vite a la red (mediante la opci\u00f3n de configuraci\u00f3n --host o server.host). Esta vulnerabilidad se corrigi\u00f3 en las versiones 4.5.12, 5.4.17, 6.0.14, 6.1.4 y 6.2.5."}], "lastModified": "2025-04-07T14:18:34.453", "sourceIdentifier": "security-advisories@github.com"}

5.3 /10