CVE-2025-31486

CVE-2025-31486 is a medium-severity vulnerability with a CVSS 3.x base score of 5.3. Its EPSS exploit-prediction score of 39% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-200.

Key facts

Description

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.

Frequently asked questions

What is CVE-2025-31486?
Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.
How severe is CVE-2025-31486?
CVE-2025-31486 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2025-31486 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 39% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-31486?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-31486 have an EU (EUVD) identifier?
Yes. CVE-2025-31486 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-9734.
When was CVE-2025-31486 published?
CVE-2025-31486 was published on 2025-04-03 and last updated on 2026-06-17.

References

Other CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerabilities

Browse all CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerabilities →