16 matches found
CVE-2025-31486-PoC
Disclaimer: The vulnerabilities described in this article and their reproduction steps are intended solely for cybersecurity research and educational purposes. No one may use the information provided herein for illegal purposes or unauthorized system testing. The author assumes no responsibility...
CVE-2025-31486
CVE-2025-31486-PoC.py url image For details on vulnerability reproduction and specific environment setup, please refer toļ¼https://chenchena.blog.csdn.net/article/details/147150357?spm=1001.2014.3001.5502...
Security Bulletin: IBM Maximo Application Suite - Manage Component uses vite-5.4.12.tgz which is vulnerable to CVE-2025-31486
Summary Security Bulletin: IBM Maximo Application Suite - Manage Component uses vite-5.4.12.tgz which is vulnerable to CVE-2025-31486. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-31486 DESCRIPTION: Vite is a frontend tooling...
Security Bulletin: Multiple security vulnerabilities in Vite affect IBM Robotic Process Automation (CVE-2025-31125, CVE-2025-32395, CVE-2025-31486).
Summary Multiple security vulnerabilities in Vite affect IBM Robotic Process Automation CVE-2025-31125, CVE-2025-32395, CVE-2025-31486. Vite is used by IBM Robotic Process Automation as part of the UI framework. This bulletin identifies the fixes required to address these vulnerabilities...
Exploit for CVE-2025-31486
CVE-2025-31486-PoC.py url !imagehttps://github.co...
CVE-2025-31486 vulnerabilities
Vulnerabilities for packages: langfuse-fips, langfuse...
Exploit for CVE-2025-31486
Disclaimer: The vulnerabilities described in this article, a...
CVE-2025-31486
Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...
@4399ywkf/bundler-vite (>=4.0.61, <=4.0.84), @4399ywkf/js (>=4.0.61, <=4.0.84) +508 more potentially affected by CVE-2025-31486 via vite (>=4.0.0, <=4.5.11)
vite NPM version =4.0.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =3.3.9-patch.1, =3.3.9-patch.2 and more Source cves: CVE-2025-31486 Source advisory: OSV:GHSA-XCJ6-PQ6G-QJ4X...
@aklesky/vite-config (1.0.0), @aminnairi/react-translate (>=0.2.0, <=1.0.0) +57 more potentially affected by CVE-2025-31486 via vite (>=6.0.0, <=6.0.11)
vite NPM version =6.0.0, =0.2.0, =4.25.19-patch.2, =19.1.0-next.0, =19.1.0-next.0, =6.0.0-beta.1, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.4.2, =0.1.10, =0.0.1, =5.0.0-alpha.32, =5.0.0-alpha.38 and more Sour...
@aicblock/cli (>=1.0.0, <=1.0.1), @angular-devkit/build-angular (>=19.2.1, <=20.0.0-next.4) +44 more potentially affected by CVE-2025-31486 via vite (>=6.2.0, <=6.2.4)
vite NPM version =6.2.0, =1.0.0, =19.2.1, =19.2.1, =0.55.0, =0.21.2-4.1, =1.0.0, =1.0.410, =3.8.0, =1.47.0, =5.0.0-alpha.40, =1.0.0-next.1, =2.0.0-next.3 and more Source cves: CVE-2025-31486 Source advisory: OSV:GHSA-XCJ6-PQ6G-QJ4X...
@adhd/react-hooks (2.2.1), @adhd/ui-react-base-hooks (>=2.2.1, <=2.3.1) +445 more potentially affected by CVE-2025-31486 via vite (>=5.0.0, <=5.4.16)
vite NPM version =5.0.0, =2.2.1, =0.0.1, =0.7.9, =4.23.1-prerelease.0, =17.1.0-next.0, =18.0.0-next.3, =1.0.25-beta.0, =0.0.1-alpha.0, =0.5.0, =2.0.0-beta.0, =3.0.0-beta.1 and more Source cves: CVE-2025-31486 Source advisory: OSV:GHSA-XCJ6-PQ6G-QJ4X...
@angular-devkit/build-angular (>=19.2.0-next.2, <=19.2.0), @angular/build (>=19.2.0-next.2, <=19.2.0) +41 more potentially affected by CVE-2025-31486 via vite (>=6.1.0, <=6.1.3)
vite NPM version =6.1.0, =19.2.0-next.2, =19.2.0-next.2, =1.0.7, =2.12.0, =2.12.0, =11.24.0, =0.0.1739797164641, =1.0.0, =0.0.0-experimental-989cf02-20250217-d62ba1cb, =0.0.0-experimental-0580205-20250209-2be35102, =0.0.0-snapshot-08bd566ea55152626f488c12d32ebce7e35b812d,...
CVE-2025-31486
Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...
CVE-2025-31486 Vite allows server.fs.deny to be bypassed with .svg or relative paths
Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...
CVE-2025-31486
Vite is affected by a local-fileāread bypass in the dev server when it is exposed to the network (e.g., started with --host or server.host). The flaw lets an attacker retrieve contents of arbitrary files smaller than build.assetsInlineLimit (default 4 kB) by crafting URLs using the ?.svg suffix a...