Cloudflare vite plugin exposes secrets over the built-in dev server
Priority MEDIUM 54CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as .env and .dev.vars. This vulnerability is fixed in 1.6.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Fix Fixed workers-sdk (cloudflare): 1.6.0@cloudflare/vite-plugin (npm): 1.6.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cloudflare | workers-sdk | before 1.6.0 | 1.6.0 | Patch available | CNA |
| — | @cloudflare/vite-plugin (npm) | before 1.6.0 | 1.6.0 | Patch available | GHSA-4pfg-2mw5-f8jx |
- workers-sdk VendorCloudflare Affected before 1.6.0 Fixed in 1.6.0 Patch available CNA
- @cloudflare/vite-plugin (npm) Vendor— Affected before 1.6.0 Fixed in 1.6.0 Patch available GHSA-4pfg-2mw5-f8jx
Remediation
- Fix · CNA workers-sdk (cloudflare) Fixed in 1.6.0
- Fix · GHSA-4pfg-2mw5-f8jx @cloudflare/vite-plugin (npm) Fixed in 1.6.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59427
- 2026-10-03 Alias added: GHSA-4pfg-2mw5-f8jx
References
Other 5
- https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-4pfg-2mw5-f8jx
- https://github.com/cloudflare/workers-sdk/commit/0e500720bf70016fa4ea21fc8959c4bd764ebc38
- https://hackerone.com/reports/3117837
- https://github.com/cloudflare/workers-sdk/discussions/3455#discussioncomment-6165773
- https://github.com/cloudflare/workers-sdk
More Cloudflare vulnerabilities
- TI-2026-12208 Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records CVSS 4.0HIGH 7.6
- TI-2014-08329 Out-of-bounds write in github.com/cloudflare/golz4 CVSS 3.1CRITICAL 9.8
- TI-2021-02817 Arbitrary filepath traversal via URI injection CVSS 3.1CRITICAL 9.8
- TI-2023-02843 Out of Bounds Slice index in cfnts leads to remote panic CVSS 3.1HIGH 8.6
- TI-2026-02435 HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing CVSS 4.0CRITICAL 9.3
- TI-2026-02433 HTTP Request Smuggling via Premature Upgrade CVSS 4.0CRITICAL 9.3
Sources
- CVE-2025-59427 · CVE Program
- CVE-2025-59427 · NVD
- FIRST EPSS
- GHSA-4pfg-2mw5-f8jx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences