CVEvulnerability

CVE-2025-24010

6.5 MEDIUM Published 2025-01-20 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-01-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-1385, CWE-346, CWE-350

Description

Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6.

Affected configurations

• vitejs vite (< 4.5.5) • vitejs vite (>= 5.0.0 < 5.4.12) • vitejs vite (>= 6.0.0 < 6.0.9)

Related

Weakness · CWE (3)

  • CWE-1385 Missing Origin Validation in WebSockets weakness
  • CWE-346 Origin Validation Error weakness
  • CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action weakness

References