CVE-2025-30208 — Vite Development Server Arbitrary File Disclosure

Affected Product: Vite (vitejs/vite), versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 Vulnerability Type: Path Traversal / Arbitrary File Read Attack Vector: Network (unauthenticated, remote) CVSS v3.1 Score: 7.5 (High)

Technical Description

Vite is a frontend build tool and development server widely used across JavaScript ecosystems, including Vue, React, Svelte, and vanilla JS projects. It is maintained under the vitejs organization on GitHub and has accumulated tens of millions of weekly npm downloads.

CVE-2025-30208 is a path traversal vulnerability present in Vite's built-in development server. The flaw exists in how Vite handles URL query parameters when resolving files to serve. Specifically, an attacker can append a crafted query string — using ?import&raw or similar parameter combinations — to a URL request targeting the Vite dev server. This bypasses the server's intended file-serving restrictions and causes the server to read and return arbitrary files from the host filesystem, including files outside the project root directory.

The root cause lies in insufficient sanitization of URL parameters before they are used in file resolution logic. Vite's dev server is designed to serve only files within the configured project root. However, the vulnerable code path processes certain query parameters in a sequence that allows the path restriction check to be circumvented before the file read occurs.

A proof-of-concept request takes the form:

GET /@fs/etc/passwd?import&raw HTTP/1.1

The @fs prefix is a Vite-specific virtual module prefix intended to allow access to filesystem resources under controlled conditions. Combined with the parameter bypass, this prefix becomes the mechanism for unauthorized file access.

Real-World Impact

This vulnerability directly affects developers running Vite's development server in environments where the server is network-accessible — intentionally or not. The most common exposure scenarios include:

  • CI/CD pipelines where the Vite dev server is started as part of a build or test workflow on a shared or cloud-hosted runner
  • Docker containers or virtual machines with the Vite dev server bound to 0.0.0.0 rather than 127.0.0.1
  • Remote development environments such as GitHub Codespaces, Gitpod, or similar cloud IDEs where port forwarding may expose the dev server externally
  • Internal development networks where lateral movement allows a compromised host to reach another developer's workstation

An unauthenticated attacker with network access to the Vite dev server port (default: 5173) can read arbitrary files readable by the process user. This includes:

  • SSH private keys (~/.ssh/id_rsa)
  • Environment files (.env, .env.local) containing API keys, database credentials, and secrets
  • Application source code and configuration files
  • System files such as /etc/passwd or /etc/shadow (on Linux hosts, depending on process privileges)
  • Cloud provider credential files (e.g., ~/.aws/credentials, ~/.config/gcloud/)

Vite's dev server is not designed for production use, and its documentation states it should not be used as a production server. However, this does not eliminate risk. Developers routinely run dev servers in shared or semi-public environments, and secrets embedded in .env files are a common target.

No public attribution to a specific threat actor campaign has been confirmed at the time of writing, but the simplicity of exploitation — a single crafted HTTP GET request — makes this vulnerability trivially weaponizable by automated scanners.

Affected Versions

| Vite Version Branch | Patched Version | |---|---| | 6.2.x | 6.2.3 | | 6.1.x | 6.1.2 | | 6.0.x | 6.0.12 | | 5.4.x | 5.4.15 | | 4.5.x | 4.5.10 |

Versions older than the 4.x branch are end-of-life and will not receive patches.

Patching and Mitigation

Primary Remediation: Update Vite to a patched version immediately.

npm update vite
# or
yarn upgrade vite
# or
pnpm update vite

Verify the installed version:

npx vite --version

Immediate Mitigations (if patching is not immediately possible):

  1. Restrict network binding. Ensure the Vite dev server binds only to 127.0.0.1 (localhost) by setting server.host: false or server.host: '127.0.0.1' in vite.config.js. This is the default behavior, but verify it has not been overridden.

  2. Firewall the dev server port. Block external access to port 5173 (or whatever port the dev server uses) at the network or host firewall level.

  3. Audit environment files. Rotate any secrets stored in .env files on systems where the Vite dev server was network-accessible while running a vulnerable version.

  4. Review CI/CD configurations. Confirm that Vite dev server is not started during CI runs on shared infrastructure with network exposure.

Organizations using Vite as a dependency in larger frameworks — including Nuxt, SvelteKit, Astro, and Remix — should verify that framework-level updates have pulled in the patched Vite version, as transitive dependency updates may not be automatic.

The fix was committed to the vitejs/vite repository and released across all supported branches. Review the official security advisory on GitHub for the canonical patch details and any updates.

Related: