Skip to content
Sign in
CVE-2025-311255.3MediumCWE-200

Vite Vitejs Improper Access Control Vulnerability

Vite · Vitejs

Exploited in the wild · in CISA KEV since 22 Jan
74.9%probability of exploitation in the next 30 days
99th percentile
050100

Higher than 99% of scored CVEs

5.3MediumCVSS 3.1
LowMedium

Federal deadline

CISA KEV · added 22 Jan · catalogue entry

Passed 259 days ago

DescriptionNVD

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Coverage4 articles · 3 outlets

First in our coverage: SecurityOnline, 23 Jan.

Full timeline
Quiet for 7 weekslast report 15 Sep4 articles3 outlets
23 Jan · SecurityOnline first14 Jun1 Aug18 SepNow
  • Fri 23 Jan, 10:16 UTC. SecurityOnline, first report. CISA Adds 4 Critical Flaws to “Must-Patch” List as Exploits Surge. Cites a CVE in CISA KEV.
  • Fri 23 Jan, 12:26 UTC. Security Affairs, its first report on the story. U.S. CISA adds Prettier eslint-config-prettier, Vite Vitejs, Versa Concerto SD-WAN orchestration platform, and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Fri 23 Jan, 15:51 UTC. The Hacker News, its first report on the story. CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilities. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 02:21 UTC. SecurityOnline. Attackers Scan Vite Servers to Steal Cloud Credentials via CVE-2026-39364. Cites a CVE in CISA KEV.
  1. Attackers Scan Vite Servers to Steal Cloud Credentials via CVE-2026-39364
    SecurityOnline · mentions it in passing
  2. CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilities
    The Hacker News · mentions it in passing
  3. U.S. CISA adds Prettier eslint-config-prettier, Vite Vitejs, Versa Concerto SD-WAN orchestration platform, and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog
    Security Affairs
  4. CISA Adds 4 Critical Flaws to “Must-Patch” List as Exploits Surge
    SecurityOnline · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in