_________________________/\\\\\\\\\\\______________________________________________________________________________________________________________________________________ _______________________/\\\/////////\\\____________________________________________________________________________________________________________________________________ ______________________\//\\\______\///____________________________________________________________/\\\_____/\\\_________/\\\__/\\\_________________________________________ _______________________\////\\\_____________/\\\\\\\\______/\\\\\\\\__/\\\____/\\\__/\\/\\\\\\\__\///___/\\\\\\\\\\\___\//\\\/\\\__________________________________________ __________________________\////\\\________/\\\/////\\\___/\\\//////__\/\\\___\/\\\_\/\\\/////\\\__/\\\_\////\\\////_____\//\\\\\___________________________________________ _____________________________\////\\\____/\\\\\\\\\\\___/\\\_________\/\\\___\/\\\_\/\\\___\///__\/\\\____\/\\\__________\//\\\____________________________________________ ______________________/\\\______\//\\\__\//\\///////___\//\\\________\/\\\___\/\\\_\/\\\_________\/\\\____\/\\\_/\\___/\\_/\\\_____________________________________________ _____________________\///\\\\\\\\\\\/____\//\\\\\\\\\\__\///\\\\\\\\_\//\\\\\\\\\__\/\\\_________\/\\\____\//\\\\\___\//\\\\/______________________________________________ _______________________\///////////_______\//////////_____\////////___\/////////___\///__________\///______\/////_____\////________________________________________________ _____________________________________________/\\\\\\\\\\\__________________/\\\_______________________________________________________________________________________________________ ___________________________________________/\\\/////////\\\_______________\/\\\_______________________________________________________________________________________________________ __________________________________________\//\\\______\///________________\/\\\_________________________/\\\_______________________________________/\\\_______________________________ ___________________________________________\////\\\__________/\\\____/\\\_\/\\\_________/\\\\\\\\\\__/\\\\\\\\\\\__/\\/\\\\\\\___/\\\\\\\\\_____/\\\\\\\\\\\_____/\\\\\\\\____________ ______________________________________________\////\\\______\/\\\___\/\\\_\/\\\\\\\\\__\/\\\//////__\////\\\////__\/\\\/////\\\_\////////\\\___\////\\\////____/\\\/////\\\___________ _________________________________________________\////\\\___\/\\\___\/\\\_\/\\\////\\\_\/\\\\\\\\\\____\/\\\______\/\\\___\///____/\\\\\\\\\\_____\/\\\_______/\\\\\\\\\\\____________ __________________________________________/\\\______\//\\\__\/\\\___\/\\\_\/\\\__\/\\\_\////////\\\____\/\\\_/\\__\/\\\__________/\\\/////\\\_____\/\\\_/\\__\//\\///////_____________ _________________________________________\///\\\\\\\\\\\/___\//\\\\\\\\\__\/\\\\\\\\\___/\\\\\\\\\\____\//\\\\\___\/\\\_________\//\\\\\\\\/\\____\//\\\\\____\//\\\\\\\\\\___________ ___________________________________________\///////////______\/////////___\/////////___\//////////______\/////____\///___________\////////\//______\/////______\//////////____________
_________________________/\\\\\\\\\\\______________________________________________________________________________________________________________________________________ _______________________/\\\/////////\\\____________________________________________________________________________________________________________________________________ ______________________\//\\\______\///____________________________________________________________/\\\_____/\\\_________/\\\__/\\\_________________________________________ _______________________\////\\\_____________/\\\\\\\\______/\\\\\\\\__/\\\____/\\\__/\\/\\\\\\\__\///___/\\\\\\\\\\\___\//\\\/\\\__________________________________________ __________________________\////\\\________/\\\/////\\\___/\\\//////__\/\\\___\/\\\_\/\\\/////\\\__/\\\_\////\\\////_____\//\\\\\___________________________________________ _____________________________\////\\\____/\\\\\\\\\\\___/\\\_________\/\\\___\/\\\_\/\\\___\///__\/\\\____\/\\\__________\//\\\____________________________________________ ______________________/\\\______\//\\\__\//\\///////___\//\\\________\/\\\___\/\\\_\/\\\_________\/\\\____\/\\\_/\\___/\\_/\\\_____________________________________________ _____________________\///\\\\\\\\\\\/____\//\\\\\\\\\\__\///\\\\\\\\_\//\\\\\\\\\__\/\\\_________\/\\\____\//\\\\\___\//\\\\/______________________________________________ _______________________\///////////_______\//////////_____\////////___\/////////___\///__________\///______\/////_____\////________________________________________________ _____________________________________________/\\\\\\\\\\\__________________/\\\_______________________________________________________________________________________________________ ___________________________________________/\\\/////////\\\_______________\/\\\_______________________________________________________________________________________________________ __________________________________________\//\\\______\///________________\/\\\_________________________/\\\_______________________________________/\\\_______________________________ ___________________________________________\////\\\__________/\\\____/\\\_\/\\\_________/\\\\\\\\\\__/\\\\\\\\\\\__/\\/\\\\\\\___/\\\\\\\\\_____/\\\\\\\\\\\_____/\\\\\\\\____________ ______________________________________________\////\\\______\/\\\___\/\\\_\/\\\\\\\\\__\/\\\//////__\////\\\////__\/\\\/////\\\_\////////\\\___\////\\\////____/\\\/////\\\___________ _________________________________________________\////\\\___\/\\\___\/\\\_\/\\\////\\\_\/\\\\\\\\\\____\/\\\______\/\\\___\///____/\\\\\\\\\\_____\/\\\_______/\\\\\\\\\\\____________ __________________________________________/\\\______\//\\\__\/\\\___\/\\\_\/\\\__\/\\\_\////////\\\____\/\\\_/\\__\/\\\__________/\\\/////\\\_____\/\\\_/\\__\//\\///////_____________ _________________________________________\///\\\\\\\\\\\/___\//\\\\\\\\\__\/\\\\\\\\\___/\\\\\\\\\\____\//\\\\\___\/\\\_________\//\\\\\\\\/\\____\//\\\\\____\//\\\\\\\\\\___________ ___________________________________________\///////////______\/////////___\/////////___\//////////______\/////____\///___________\////////\//______\/////______\//////////____________
cve

CVE-2025-31125: Vite Dev Server File Exposure Under Active Attack

Security Substrate

— 5 min read

CVE-2025-31125: Vite Dev Server File Exposure Under Active Attack

CVE ID: CVE-2025-31125

Severity: MEDIUM | CVSS: 5.3

Sources: 2 different security sources

Status: ACTIVELY EXPLOITED - Added to CISA KEV Catalog

Let Me Explain What Happened

Here's what's going on, and I want you to understand this clearly because it's important: A vulnerability in Vite, a popular JavaScript development tool used by countless web developers, is now being actively exploited in the wild. The Cybersecurity and Infrastructure Security Agency (CISA) added this to their Known Exploited Vulnerabilities catalog on January 22, 2026, which means attackers are already using this weakness to target real systems.

Think of it this way: Vite runs a development server on your computer while you're building websites. Normally, this server only shares the files you intend to share. But this vulnerability is like leaving a window unlocked—attackers can trick the server into handing over files you never meant to expose, potentially including configuration files, source code, or sensitive credentials. The good news? This only affects you if you've explicitly opened your development server to the network, but if you have, you need to act now.

A Bit More Detail

The vulnerability exploits special query parameters in Vite's development server—specifically ?inline&import and ?raw?import. These parameters are meant to help developers work with files in specific ways, but they can be manipulated to bypass Vite's normal access controls. An attacker who can reach your development server over the network can craft requests that expose files outside the intended project directory.

This is particularly concerning because development servers often contain sensitive information that would never appear in production: API keys in configuration files, database credentials in environment files, or proprietary source code. The attack complexity is rated as "High" by NVD, meaning it requires specific conditions, but the fact that CISA has observed active exploitation tells us attackers have figured out how to meet those conditions.

The Technical Specifics

  • Attack Vector: NETWORK (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
  • Attack Complexity: High - Requires the dev server to be exposed to the network
  • Privileges Required: None
  • User Interaction: Required
  • Impact: High Confidentiality impact, no Integrity or Availability impact
  • Affected Products: Vite versions prior to:
    • 6.2.4 (version 6.2.x branch)
    • 6.1.3 (version 6.1.x branch)
    • 6.0.13 (version 6.0.x branch)
    • 5.4.16 (version 5.x branch)
    • 4.5.11 (version 4.x branch)
  • CWE Classifications:
    • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
    • CWE-284: Improper Access Control
  • Exploitation Condition: Only affects applications that explicitly expose the Vite dev server to the network using --host flag or server.host configuration option

Who's Actually at Risk Here?

Let me be clear about this so you don't panic unnecessarily. You're only vulnerable if both of these conditions are true:

  • You're running a Vite development server with an affected version (anything before the patched versions listed above)
  • You've configured that server to accept connections from the network (using vite --host or setting server.host in your configuration)

By default, Vite only listens on localhost, meaning only your own computer can connect to it. But many developers expose their dev servers to the network for legitimate reasons—testing on mobile devices, sharing work with colleagues, or working in containerized environments. If you've done this, you need to take action immediately.

The fact that CISA has added this to their KEV catalog means federal agencies are required to patch by a specific deadline, but more importantly for you, it means threat actors are actively scanning for and exploiting vulnerable Vite servers right now.

What You Should Do About This

  • Right Now (Emergency Response):
    • Identify exposed servers: Check all your development environments to see if any Vite servers are running with --host or have server.host configured. Look in your package.json scripts and vite.config.js files.
    • Isolate if necessary: If you find exposed servers and can't patch immediately, remove the --host flag or server.host configuration to restrict access to localhost only. This breaks the attack vector while you prepare to update.
    • Review access logs: If you maintain logs for your development servers (many don't by default), look for suspicious requests containing ?inline&import or ?raw?import parameters, especially those requesting files outside your normal project structure.
    • Audit exposed files: Assume that any files accessible to your development server may have been exposed. Review configuration files, environment variables, and source code for sensitive information like API keys, credentials, or proprietary algorithms.
  • For the Long Term (Remediation):
    • Update Vite immediately: Upgrade to the patched version appropriate for your branch:
      • If on 6.2.x: Update to 6.2.4 or later
      • If on 6.1.x: Update to 6.1.3 or later
      • If on 6.0.x: Update to 6.0.13 or later
      • If on 5.x: Update to 5.4.16 or later
      • If on 4.x: Update to 4.5.11 or later
    • Rotate credentials: If your development environment contained any credentials, API keys, or secrets, rotate them. Even if you don't see evidence of exploitation, the risk is too high to ignore.
    • Review network exposure policies: Establish clear guidelines for when and how development servers should be exposed to the network. Consider using VPNs or SSH tunnels instead of directly exposing dev servers.
    • Implement network segmentation: If you must expose development servers, ensure they're on isolated network segments that don't have access to production resources or sensitive internal systems.

How to Detect If You've Been Targeted

Detection is challenging because many development environments don't maintain detailed access logs, but here's what you can look for:

  • Web server logs: Search for HTTP requests containing the patterns ?inline&import or ?raw?import, particularly those requesting files with paths like ../ (directory traversal attempts)
  • Network monitoring: Look for unusual outbound connections from development machines, especially to unfamiliar IP addresses or domains
  • File access patterns: If you have file integrity monitoring, check for unexpected reads of configuration files, .env files, or files outside your normal project directories

If you're using a SIEM system, here's a basic detection query concept (adapt to your specific SIEM syntax):

http.request.uri.query CONTAINS "inline&import" OR http.request.uri.query CONTAINS "raw?import"
AND process.name = "node" OR process.name = "vite"
AND NOT (source.ip IN internal_developer_ips)

Going Deeper: The Security Context

This vulnerability maps to the MITRE ATT&CK framework under several techniques:

  • T1213 - Data from Information Repositories: Attackers are accessing stored information (source code, configuration files) from the development server
  • T1005 - Data from Local System: The vulnerability allows reading files from the local filesystem where the dev server runs
  • T1078 - Valid Accounts: While not directly related to accounts, the vulnerability bypasses normal access controls, achieving similar results

The CVSS score of 5.3 (MEDIUM) might seem modest, but don't let that fool you. The score reflects the specific conditions required for exploitation (high attack complexity, user interaction required). However, when those conditions are met—and CISA's KEV listing confirms they are being met in the wild—the impact is significant: complete exposure of potentially sensitive files.

The CWE-200 (Information Exposure) and CWE-284 (Improper Access Control) classifications tell us this is fundamentally about the application failing to properly restrict which files can be accessed through the web interface. The fix, implemented in commit 59673137c45ac2bcfad1170d954347c1a17ab949, strengthens these access controls to prevent the bypass.

Why This Matters Beyond Just Vite

Let me share something important with you: This vulnerability represents a broader pattern we're seeing in development tools. As the line between development and production environments blurs—with containerization, cloud development environments, and remote work—development servers are increasingly exposed to networks in ways their creators never anticipated.

Vite is used by major frameworks like Vue, React, and Svelte. It's in countless development pipelines. The fact that attackers are actively exploiting this suggests they understand the value of targeting development infrastructure: source code theft, credential harvesting, and supply chain positioning.

Where I Found This Information

Note: This is automated security intelligence based on multiple sources. Always test updates carefully in a development environment before applying them to production systems. The CISA KEV listing indicates active exploitation, making this a priority for immediate action if you're affected.

Read more