CVE-2025-31125 Vite Vitejs
Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
- CVSS
- not scored
On CISA’s exploited list
Vite Vitejs Improper Access Control Vulnerability
- Added
- 2026-01-22
- Federal patch deadline
- 2026-02-12
- Ransomware use
- not known