Vite allows any websites to send any requests to the development server and read the response
Priority MEDIUM 62CWE-1385Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.
Summary
Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00297 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed vite (vitejs): 6.0.9, 5.4.12, 4.5.6vite (npm): 6.0.9, 5.4.12, 4.5.6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vitejs | vite | 6.0.0 to before 6.0.9; 5.0.0 to before 5.4.12; before 4.5.6 | 6.0.9, 5.4.12, 4.5.6 | Patch available | CNA |
| — | vite (npm) | 6.0.0 to before 6.0.9 | 6.0.9 | Patch available | GHSA-vg6x-rcgg-rjx6 |
| — | vite (npm) | 5.0.0 to before 5.4.12 | 5.4.12 | Patch available | GHSA-vg6x-rcgg-rjx6 |
| — | vite (npm) | before 4.5.6 | 4.5.6 | Patch available | GHSA-vg6x-rcgg-rjx6 |
- vite Vendorvitejs Affected 6.0.0 to before 6.0.9; 5.0.0 to before 5.4.12; before 4.5.6 Fixed in 6.0.9, 5.4.12, 4.5.6 Patch available CNA
- vite (npm) Vendor— Affected 6.0.0 to before 6.0.9 Fixed in 6.0.9 Patch available GHSA-vg6x-rcgg-rjx6
- vite (npm) Vendor— Affected 5.0.0 to before 5.4.12 Fixed in 5.4.12 Patch available GHSA-vg6x-rcgg-rjx6
- vite (npm) Vendor— Affected before 4.5.6 Fixed in 4.5.6 Patch available GHSA-vg6x-rcgg-rjx6
Remediation
- Fix · CNA vite (vitejs) Fixed in 6.0.9, 5.4.12, 4.5.6
- Fix · GHSA-vg6x-rcgg-rjx6 vite (npm) Fixed in 6.0.9 Advisory →
- Fix · GHSA-vg6x-rcgg-rjx6 vite (npm) Fixed in 5.4.12 Advisory →
- Fix · GHSA-vg6x-rcgg-rjx6 vite (npm) Fixed in 4.5.6 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 4 products
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Keycloak
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-10-02 Threatist record created from CVE-2025-24010
- 2026-10-03 Alias added: GHSA-vg6x-rcgg-rjx6
References
More vitejs Vite vulnerabilities
- TI-2025-22386 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query KEVCVSS 3.1HIGH 7.5
- TI-2026-28350 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVSS 4.0HIGH 8.2
- TI-2025-21544 Vite bypasses server.fs.deny when using `?raw??` CVSS 3.1HIGH 7.5
- TI-2023-16938 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVSS 3.1HIGH 7.5
- TI-2026-38634 Vite: `server.fs.deny` bypass on Windows alternate paths CVSS 4.0HIGH 8.2
- TI-2026-28352 Vite has a Path Traversal in Optimized Deps `.map` Handling CVSS 4.0MEDIUM 6.3
Sources
- CVE-2025-24010 · CVE Program
- CVE-2025-24010 · NVD
- FIRST EPSS
- GHSA-vg6x-rcgg-rjx6 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-24010 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences