Vulnerability intelligence
CVE-2025-31125
Vite Vitejs Improper Access Control Vulnerability
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
CVSS Score
5.3
Medium
EPSS — Exploit Probability
58%
Riskier than 99% of all CVEs · checked 2026-09-15
Exploitation
Confirmed in the wild
KEV since 2026-01-22
Remediation
Unconfirmed
Federal deadline 2026-02-12
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-02-12.
4 articles across 3 outlets · first covered Jan 23, 2026 · latest Sep 15, 2026
Coverage timeline
-
Attackers Exploit Vite Flaw to Steal Cloud Credentials from Serverssecurityonline.info · Sep 15, 2026
-
CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilitiesthehackernews.com · Jan 23, 2026
-
-
CISA Adds 4 Critical Flaws to “Must-Patch” List as Exploits Surgesecurityonline.info · Jan 23, 2026