CVE-2025-30208-31125-31486-32395

Vite Vulnerability Exploitation Guide CVE-2025-30208/31125/31486/32395 This document summarizes exploitation methods for four arbitrary file read vulnerabilities in the Vite development server, including examples for Linux and Windows systems. Note: For use only in authorized security testing...

CVE-2025-30208

🔥 CVE-2025-30208 Vite Arbitrary File Read Vulnerability Scanner Advanced vulnerability scanner for CVE-2025-30208 with enterprise-grade features Professional penetration testing tool for Vite Arbitrary File Read vulnerability detection 🚀 Quick Start • 📋 Features • 🔧 Usage • 📊 Examples • 🛡️ Securit...

ViteVulScan

ViteVulScan Vulnerability Introduction This project covers 3 vulnerabilities: CVE-2025-30208, CVE-2025-31125, CVE-2025-31486. All are arbitrary file reading vulnerabilities in the Vite development server. These three vulnerabilities have broad coverage and are easy to exploit without restrictions...

CVE-2025-30208

中文 | English Vite Dev Server Vulnerability Scanner 一个内外网通吃的自动化扫描器 An automated tool for scanning Vite development server vulnerabilities. This tool utilizes the FOFA API to collect potential targets and automatically detects specific vulnerabilities. Features Auto Automatic target asset collectio...

CVE-2025-30208-EXP

CVE-2025-30208-EXP Vite development server arbitrary file read vulnerability CVE-2025-30208, with wide coverage, simple exploitation, and no restrictions, posing a huge threat! Fofa search syntax: body="/@vite/client" Hunter search syntax: web.body="/@vite/client" Exp script usage -u to check -p...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Vulnerability Overview CVE-2025-30208, CVE-2025-31125 and CVE-2025-31486 are arbitrary file reading vulnerabilities in the Vite development server. These vulnerabilities allow an attacker to bypass access controls through specific URL parameters...

CVE-2025-30208

CVE-2025-30208 — Vite Arbitrary File Read · v5 CVE: CVE-2025-30208 GHSA: GHSA-x574-m823-4x7w Severity: CVSS 5.3 Medium network-accessible dev server ⚠ For authorized security engagements only. Unauthorized use against systems you do not own or have explicit written permission to test is illegal...

Path-Transversal-CVE-2025-31125-

Vite Exploit CVE-2025-31125 Description: Exploits path traversal in Vite Development Server's @fs endpoint CVE-2025-31125 to access sensitive files like /etc/passwd and /etc/hosts via crafted URLs. Created by Harsh Gupta. Usage: python viteexploit.py -u http://target.com python viteexploit.py -f...

CVE-2025-30208

🔥 Vite Dev Server Vulnerability Scanner CVE-2025-30208 🚀 Overview This tool scans for CVE-2025-30208, a vulnerability in the Vite Dev Server. It allows security researchers to quickly detect vulnerable instances using multiple payloads. ⚡ Features ✅ Single URL scanning -u URL ✅ Mass scanning from...

Vite Development Server - Path Traversal

Path traversal vulnerability in Vite development server's @fs endpoint allows attackers to access files outside the intended directory. When exposed to the network, attackers can exploit this via crafted URLs to access sensitive system files. id: CVE-2025-31125 info: name: Vite Development Server...

Vite Dev Server - Path Traversal

Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the server.fs settings. Only apps that explicitly expose the Vite dev server to the network using --host or...

Vite Dev Server - Information Exposure

Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...

Vite Dev Server - Information Exposure

Vite dev server could allow reading files from the Vite project root by bypassing server.fs.deny with double forward-slash paths //. This affects exposed dev servers only. id: CVE-2023-34092 info: name: Vite Dev Server - Information Exposure author: ritikchaddha severity: high description: | Vite...

Vite - Path Traversal

Vite versions prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13 contain a file exposure vulnerability caused by improper handling of request URLs with '' in the dev server running on Node or Bun, letting attackers access arbitrary files, exploit requires the server to be exposed to the network an...

Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...

Vite server.fs.deny Bypass - Local File Inclusion

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...

Vite dev server - Cross-Site Scripting

Vite's dev server, when used with appType: 'custom' and manually invoking server.transformIndexHtml using the unmodified request URL, is vulnerable to XSS via a crafted URL payload. If the HTML being served includes an inline module script ..., an attacker can inject a script via the URL,...

ai-agent-gateway

@tuskira/gateway-web Admin console for the Tuskira AI Agent Gateway. React 19 + Vite + TypeScript strict + Tailwind CSS 4 + shadcn/ui. Develop Requires Node 26+ and npm 11+ no pnpm. npm install npm run dev The dev server proxies /api to http://localhost:8081 see vite.config.ts, so run the gateway...

cve-2023-28771-demo

React + TypeScript + Vite This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules. Currently, two official plugins are available: @vitejs/plugin-react uses Babel for Fast Refresh @vitejs/plugin-react-swc uses SWC for Fast Refresh Expanding the ESLint...

CVE-2026-39363

CVE-2026-39363 — Vite Dev Server WebSocket Arbitrary File Read Batch Detection Disclaimer: This tool is intended for authorized security testing and educational research only. Users must comply with local laws and regulations; unauthorized scanning or attacking others' systems is illegal. The...