Vite allows server.fs.deny to be bypassed with .svg or relative paths

Description

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.

Scores

EPSS (exploitation in 30 days)

40.5% · top 1.3% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)All about CWE-200 and its CVEs
• CWE-284: Improper Access Control (opens in a new tab)All about CWE-284 and its CVEs

Affected products

• vitejs · vite

  • affected < 4.5.12
  • affected >=5.0.0, < 5.4.17
  • affected >=6.0.0, < 6.0.14
  • affected >=6.1.0, < 6.1.4
  • affected >=6.2.0, < 6.2.5

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• npmviteGHSA-xcj6-pq6g-qj4x (opens in a new tab)

References (3)

• https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x (opens in a new tab)x_refsource_CONFIRMexploit
• https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647 (opens in a new tab)x_refsource_MISC
• https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-xcj6-pq6g-qj4x (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-31486](https://trackcve.app/badge/CVE-2025-31486.svg)](https://trackcve.app/cve/CVE-2025-31486)

Record last updated 3 Apr 2025, 20:39 UTC.