{"id":"vite-dev-server-file-exposure-jan-2026","category":"patch","status":"closed","title":"Vite development-server file exposure CVE-2025-31125 exploited despite available fixes","tldr":"Attackers are using CVE-2025-31125 to read restricted files from network-exposed Vite development servers. Fixes have existed since March 2025. Developers should update Vite, remove public access and replace potentially exposed credentials.","summary":"Vite, a tool developers use to build websites, can disclose restricted files through its development server because of CVE-2025-31125. Only servers explicitly exposed to a network are affected. Vite published fixes in March 2025 across its affected release branches, but CISA confirmed exploitation on 22 January 2026. In September, F5 reported August scanning that included this flaw and sought cloud credentials and configuration files. Those observations do not establish which organisations lost secrets or whether cloud accounts were subsequently compromised. As of 3 November 2026, fixes remain available; updating does not invalidate credentials already exposed. Vite’s current advisory rates the flaw high at 8.9 under CVSS 4.0, while NVD gives it 7.5 under CVSS 3.1.","action":"Most families have nothing to update themselves: this affects website development systems. If you or your business use Vite, ask the developer to install the latest supported release, remove public access to development servers and replace credentials that an exposed server could have disclosed.","product":"Vite development server","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2025-31125"],"tags":["vite","development-server","access-control","information-disclosure","actively-exploited"],"affected":["Vite <=4.5.10","Vite >=5.0.0, <=5.4.15","Vite >=6.0.0, <=6.0.12","Vite >=6.1.0, <=6.1.2","Vite >=6.2.0, <=6.2.3","Only applications explicitly exposing the Vite development server to the network are affected."],"fixed":["4.5.11","5.4.16","6.0.13","6.1.3","6.2.4"],"matches":[],"sources":[{"kind":"advisory","title":"server.fs.deny bypassed for inline and raw with ?import query","url":"https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8","by":"Vite","date":"2025-03-31"},{"kind":"advisory","title":"CVE-2025-31125 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2025-31125","by":"NIST NVD","date":"2025-03-31"},{"kind":"news","title":"CISA confirms active exploitation of four enterprise software bugs","url":"https://www.bleepingcomputer.com/news/security/cisa-confirms-active-exploitation-of-four-enterprise-software-bugs/","by":"BleepingComputer","date":"2026-01-23"},{"kind":"research","title":"Cloud Takeover: Mass Scanning for Exposed Vite Endpoints (CVE-2026-39364)","url":"https://www.f5.com/labs/articles/cloud-takeover-mass-scanning-for-exposed-vite-endpoints-cve-2026-39364","by":"F5 Labs","date":"2026-09-11"},{"kind":"news","title":"Hackers target exposed Vite dev servers to steal AWS, Azure secrets","url":"https://www.bleepingcomputer.com/news/security/hackers-target-exposed-vite-dev-servers-to-steal-aws-azure-secrets/","by":"BleepingComputer","date":"2026-09-14"}],"started":"2026-01-22","closed":"2026-09-11","created":"2026-11-03T22:29:53.257Z","updated":"2026-11-03T22:29:53.257Z","cve_notes":[{"cve":"CVE-2025-31125","name":"Restricted-file disclosure in Vite development servers","what":"A bypass of Vite’s development-server file restrictions lets an unauthenticated attacker read files that should be blocked when the server is exposed to a network.","severity":"high","cvss":8.9}],"timeline":[{"at":"2026-09-11","added":"2026-11-03T22:22:59.664Z","kind":"wider-attacks","text":"F5 reported August scanning for AWS credentials, Azure tokens and other secrets on exposed Vite servers, including attempts matching this flaw. The wider campaign generated 807 grouped attacks and roughly 32,000 events across several Vite vulnerabilities, not this CVE alone.","url":"https://www.f5.com/labs/articles/cloud-takeover-mass-scanning-for-exposed-vite-endpoints-cve-2026-39364","by":"F5 Labs","patch":null},{"at":"2026-01-22","added":"2026-11-03T22:22:59.664Z","kind":"cisa-added","text":"CISA added the flaw to its Known Exploited Vulnerabilities catalogue, confirming exploitation. Its remediation deadline for covered US federal agencies was 12 February 2026.","url":"https://nvd.nist.gov/vuln/detail/cve-2025-31125","by":"NIST NVD","patch":null},{"at":"2025-03-31","added":"2026-11-03T22:22:59.664Z","kind":"disclosed","text":"Vite disclosed CVE-2025-31125, which lets attackers read restricted files through network-exposed development servers. Fixes were available in 4.5.11, 5.4.16, 6.0.13, 6.1.3 and 6.2.4.","url":"https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8","by":"Vite","patch":"patched"}],"url":"https://hard.fyi/live/vite-dev-server-file-exposure-jan-2026/","json":"https://hard.fyi/api/live?id=vite-dev-server-file-exposure-jan-2026"}