CVE-2025-24010

Vite allows any websites to send any requests to the development server and read the response

State: Published
Severity: 6.5 Medium
Published: Jan 20, 2025
Updated: Jan 21, 2025
Reserved: Jan 16, 2025

Description

Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-346 Origin Validation Error
CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action
CWE-1385 Missing Origin Validation in WebSockets

Affected Products

Product	Versions
vitevitejs	>= 6.0.0, < 6.0.9Affected >= 5.0.0, < 5.4.12Affected < 4.5.6Affected

References

https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.