Vite's `server.fs` settings were not applied to HTML files
Priority MEDIUM 45CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 5 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200 and CWE-284.
Summary
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00608 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial vite (vitejs): 5.4.20, 6.3.6, 7.0.7 +1vite (npm): 7.1.5, 7.0.7, 6.3.6 +1Red Hat: 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vitejs | vite | before 5.4.20; 6.0.0 to before 6.3.6; 7.0.0 to before 7.0.7; 7.1.0 to before 7.1.5 | 5.4.20, 6.3.6, 7.0.7, 7.1.5 | Patch available | CNA |
| — | vite (npm) | 7.1.0 to before 7.1.5 | 7.1.5 | Patch available | GHSA-jqfw-vq24-v9c3 |
| — | vite (npm) | 7.0.0 to before 7.0.7 | 7.0.7 | Patch available | GHSA-jqfw-vq24-v9c3 |
| — | vite (npm) | 6.0.0 to before 6.3.6 | 6.3.6 | Patch available | GHSA-jqfw-vq24-v9c3 |
| — | vite (npm) | before 5.4.20 | 5.4.20 | Patch available | GHSA-jqfw-vq24-v9c3 |
- vite Vendorvitejs Affected before 5.4.20; 6.0.0 to before 6.3.6; 7.0.0 to before 7.0.7; 7.1.0 to before 7.1.5 Fixed in 5.4.20, 6.3.6, 7.0.7, 7.1.5 Patch available CNA
- vite (npm) Vendor— Affected 7.1.0 to before 7.1.5 Fixed in 7.1.5 Patch available GHSA-jqfw-vq24-v9c3
- vite (npm) Vendor— Affected 7.0.0 to before 7.0.7 Fixed in 7.0.7 Patch available GHSA-jqfw-vq24-v9c3
- vite (npm) Vendor— Affected 6.0.0 to before 6.3.6 Fixed in 6.3.6 Patch available GHSA-jqfw-vq24-v9c3
- vite (npm) Vendor— Affected before 5.4.20 Fixed in 5.4.20 Patch available GHSA-jqfw-vq24-v9c3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* | before 5.4.20; 6.0.0 to before 6.3.6; 7.0.0 to before 7.0.7; 7.1.0 to before 7.1.5 | Vulnerable | vitejs |
- cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* Versions before 5.4.20; 6.0.0 to before 6.3.6; 7.0.0 to before 7.0.7; 7.1.0 to before 7.1.5 Vulnerable ·vitejs
Remediation
- Fix · CNA vite (vitejs) Fixed in 5.4.20, 6.3.6, 7.0.7, 7.1.5
- Fix · GHSA-jqfw-vq24-v9c3 vite (npm) Fixed in 7.1.5 Advisory →
- Fix · GHSA-jqfw-vq24-v9c3 vite (npm) Fixed in 7.0.7 Advisory →
- Fix · GHSA-jqfw-vq24-v9c3 vite (npm) Fixed in 6.3.6 Advisory →
- Fix · GHSA-jqfw-vq24-v9c3 vite (npm) Fixed in 5.4.20 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-58752
- 2026-10-03 Alias added: GHSA-jqfw-vq24-v9c3
References
Patch 4
- https://github.com/vitejs/vite/commit/0ab19ea9fcb66f544328f442cf6e70f7c0528d5f
- https://github.com/vitejs/vite/commit/14015d794f69accba68798bd0e15135bc51c9c1e
- https://github.com/vitejs/vite/commit/482000f57f56fe6ff2e905305100cfe03043ddea
- https://github.com/vitejs/vite/commit/6f01ff4fe072bcfcd4e2a84811772b818cd51fe6
More vitejs Vite vulnerabilities
- TI-2025-22386 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query KEVCVSS 3.1HIGH 7.5
- TI-2026-28350 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVSS 4.0HIGH 8.2
- TI-2025-21544 Vite bypasses server.fs.deny when using `?raw??` CVSS 3.1HIGH 7.5
- TI-2023-16938 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVSS 3.1HIGH 7.5
- TI-2026-38634 Vite: `server.fs.deny` bypass on Windows alternate paths CVSS 4.0HIGH 8.2
- TI-2026-28352 Vite has a Path Traversal in Optimized Deps `.map` Handling CVSS 4.0MEDIUM 6.3
Sources
- CVE-2025-58752 · CVE Program
- CVE-2025-58752 · NVD
- FIRST EPSS
- GHSA-jqfw-vq24-v9c3 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-58752 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences