CVE-2025-58751

What it actually does

A path sanitization vulnerability in the Vite development server allows an unauthenticated remote attacker to bypass file system access controls configured in `server.fs`. By crafting a special request for a file that shares a name prefix with a file in the public directory, an attacker can read arbitrary files from the file system, leading to information disclosure.

Why it matters to the business

Exploitation of this vulnerability can lead to a significant data breach. Attackers can access sensitive information directly from the server's file system, including application source code, configuration files, and environment files which may contain API keys, database credentials, and other secrets. The availability of weaponized exploits increases the likelihood of attack, potentially leading to intellectual property theft, further network compromise, and reputational damage.

How an attack unfolds

An attacker first identifies a web application using a vulnerable version of the Vite development server. The attacker then crafts a specialized HTTP GET request. This request targets a sensitive file (e.g., `.env`, `vite.config.js`) but is constructed in a way that it appears to be requesting a legitimate public asset. The vulnerable server fails to properly validate the file path, bypassing the `server.fs.deny` restrictions. As a result, the server reads the sensitive file from the disk and sends its contents back to the attacker in the HTTP response.

How to fix it

To remediate this vulnerability, update the `vite` package to a version that includes the fix. The vulnerability was patched in commit `997700f01c7199daf7330d33a7fd3a43b2e9e3ba`. Run the appropriate command for your package manager to update `vite` to the latest secure version (e.g., `npm update vite` or `yarn upgrade vite`). As a general security practice, avoid running development servers in production environments and ensure they are not exposed to the public internet.

How to confirm the fix worked

To validate the remediation, first confirm that the `vite` package has been upgraded to a patched version by checking your project's lock file (`package-lock.json`, `yarn.lock`) or by running `npm list vite`. To test for the vulnerability, you can attempt to access a known sensitive file from outside the project's public directory using a crafted URL pattern. A properly patched system should deny the request, typically with a 403 Forbidden or 404 Not Found status code. A vulnerable system would return a 200 OK and the contents of the file.

Typical attack path

1. An attacker identifies a target running an exposed Vite development server.
2. The attacker sends a crafted HTTP GET request designed to bypass access controls.
3. The request targets a known sensitive file path outside the intended web root, such as `/.env` or `/vite.config.js`.
4. The vulnerable Vite server processes the request and, due to the flaw, serves the contents of the restricted file.
5. The attacker receives the sensitive file contents, potentially gaining credentials or application source code.
6. The attacker uses the exfiltrated information for further attacks against the application or infrastructure.

How to detect it

To detect potential exploitation, administrators should review access logs of systems running the Vite development server. Look for successful HTTP GET requests (status code 200) for files that are not meant to be public. Attackers will typically target common configuration and source code files. The presence of requests for files like `.env`, `vite.config.js`, `package.json`, or source files outside the public directory that were successfully served is a strong indicator of compromise.

• 200 OK in access log for GET /.env
• 200 OK in access log for GET /vite.config.js
• 200 OK in access log for GET /package.json
• 200 OK in access log for GET /..
• 200 OK in access log for GET /%2e%2e%2f

What your security team should do

• Immediately prioritize upgrading all instances of `vite` across all development and testing environments, as this vulnerability has weaponized exploits available.
• Scan your network for any publicly exposed Vite development servers and ensure they are firewalled from public access.
• Review web server access logs for HTTP GET requests that resulted in a 200 OK response for sensitive files like `.env`, `vite.config.js`, or `package.json`.
• Implement a policy against storing secrets in version-controlled configuration files; use a dedicated secrets management solution instead.