« Volver al listado

CVE-2025-31486

Estado: AplazadaMedia (5.3)—

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Vitejs — ViteAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-31486",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-31486",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-03T20:39:24.672022Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "vitejs",
          "product": "vite",
          "versions": [
            {
              "status": "affected",
              "version": "< 4.5.12"
            },
            {
              "status": "affected",
              "version": ">=5.0.0, < 5.4.17"
            },
            {
              "status": "affected",
              "version": ">=6.0.0, < 6.0.14"
            },
            {
              "status": "affected",
              "version": ">=6.1.0, < 6.1.4"
            },
            {
              "status": "affected",
              "version": ">=6.2.0, < 6.2.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-03T19:15:39.890",
  "references": [
    {
      "url": "https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5."
    },
    {
      "lang": "es",
      "value": "Vite es un framework de herramientas frontend para JavaScript. El contenido de archivos arbitrarios se puede devolver al navegador. Al añadir ?.svg con ?.wasm?init o con el encabezado de script sec-fetch-dest:, se pudo omitir la restricción server.fs.deny. Esta omisión solo es posible si el archivo es menor que build.assetsInlineLimit (valor predeterminado: 4 KB) y al usar Vite 6.0 o posterior. Solo se ven afectadas las aplicaciones que exponen explícitamente el servidor de desarrollo de Vite a la red (mediante la opción de configuración --host o server.host). Esta vulnerabilidad se corrigió en las versiones 4.5.12, 5.4.17, 6.0.14, 6.1.4 y 6.2.5."
    }
  ],
  "lastModified": "2026-06-17T09:10:29.170",
  "sourceIdentifier": "security-advisories@github.com"
}