CVSS 4.0
6.0 mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NCVE-2025-46565
Medium (6.0) in vitejs vite. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in vite 4.5.14, 5.4.19, 6.1.6.
Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.
Severity
CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vitejs:vite
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-859w-5945-r5v3 | npm | vite | >=6.3.0 <6.3.4 | 6.3.4 |
| GHSA-859w-5945-r5v3 | npm | vite | >=6.2.0 <6.2.7 | 6.2.7 |
| GHSA-859w-5945-r5v3 | npm | vite | >=6.0.0 <6.1.6 | 6.1.6 |
| GHSA-859w-5945-r5v3 | npm | vite | >=5.0.0 <5.4.19 | 5.4.19 |
| GHSA-859w-5945-r5v3 | npm | vite | <4.5.14 | 4.5.14 |