CVE-2025-58752
⚪ Do wiadomości
Błąd w Vite umożliwia serwowanie plików HTML z dowolnej lokalizacji, co stwarza ryzyko ujawnienia danych.
CVSS
5.3
EPSS
0.6%
Exploit
poc
Vendor
vitejs
Opis źródłowy (NVD)
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.
exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 5.3 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.6% |
| Opublikowano (NVD) | 2025-09-08 23:15:36 UTC |
| Ostatnia modyfikacja (NVD) | 2026-09-30 23:10:00 UTC |
Referencje
- https://github.com/vitejs/vite/commit/0ab19ea9fcb66f544328f442cf6e70f7c0528d5f ([email protected]) [Patch]
- https://github.com/vitejs/vite/commit/14015d794f69accba68798bd0e15135bc51c9c1e ([email protected]) [Patch]
- https://github.com/vitejs/vite/commit/482000f57f56fe6ff2e905305100cfe03043ddea ([email protected]) [Patch]
- https://github.com/vitejs/vite/commit/6f01ff4fe072bcfcd4e2a84811772b818cd51fe6 ([email protected]) [Patch]
- https://github.com/vitejs/vite/security/advisories/GHSA-jqfw-vq24-v9c3 ([email protected]) [Exploit, Third Party Advisory]