ACTIVELY EXPLOITED
CVE-2025-31125: Vite Vitejs Improper Access Control Vulnerability
| Vendor | Vite |
|---|---|
| Product | Vitejs |
| Actively exploited | Yes |
| Added to CISA KEV | 22 Jan 2026 |
| CISA federal deadline | 12 Feb 2026 |
| Weakness (CWE) | CWE-200, CWE-284 |
Required action (CISA's text)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
SOURCES
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.