CVE-2025-30208

中文 | English Vite Dev Server Vulnerability Scanner 一个内外网通吃的自动化扫描器 An automated tool for scanning Vite development server vulnerabilities. This tool utilizes the FOFA API to collect potential targets and automatically detects specific vulnerabilities. Features Auto Automatic target asset collectio...

cve-2023-28771-demo

React + TypeScript + Vite Esta plantilla proporciona una configuración mínima para que React funcione en Vite con HMR y algunas reglas de ESLint. Actualmente, hay dos complementos oficiales disponibles: @vitejs/plugin-react usa Babel para Fast Refresh @vitejs/plugin-react-swc usa SWC para Fast...

CVE-2025-30208-EXP

CVE-2025-30208-EXP Vite development server arbitrary file read vulnerability CVE-2025-30208, with wide coverage, simple exploitation, and no restrictions, posing a huge threat! Fofa search syntax: root@kitploit: body="/@vite/client" Hunter search syntax: root@kitploit: web.body="/@vite/client" Ex...

CVE-2026-39363

CVE-2026-39363 — Vite Dev Server WebSocket Arbitrary File Read Batch Detection Disclaimer: This tool is intended for authorized security testing and educational research only. Users must comply with local laws and regulations; unauthorized scanning or attacking others' systems is illegal. The...

CVE-2026-39363

CVE-2026-39363 Vite Dev Server WebSocket Arbitrary File Read Vulnerability Vulnerability Overview...

CVE-2026-39363

CVE-2026-39363 — Vite Dev Server Arbitrary File Read PoC A drop-in PoC for GHSA-p9ff-h696-f583. It reads arbitrary files from the machine running the dev server by calling fetchModule over an unauthenticated HMR WebSocket, bypassing the HTTP-layer server.fs.allow restriction. Affected Versions...

CVE-2025-30208-Vite

CVE-2025-30208 | Vite Script This tool is used to detect whether the target system has the CVE-2025-30208 vulnerability. This vulnerability allows an attacker to read sensitive files such as /etc/passwd or C:\windows\win.ini from the server via a specific path. The tool supports single URL...

CVE-2025-30208-31125-31486-32395

Vite Vulnerability Exploitation Guide CVE-2025-30208/31125/31486/32395 This document summarizes exploitation methods for four arbitrary file read vulnerabilities in the Vite development server, including examples for Linux and Windows systems. Note: For use only in authorized security testing...

Vite server.fs.deny Bypass - Local File Inclusion

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...

Vite - Path Traversal

Vite versions prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13 contain a file exposure vulnerability caused by improper handling of request URLs with '' in the dev server running on Node or Bun, letting attackers access arbitrary files, exploit requires the server to be exposed to the network an...

Vite Dev Server - Information Exposure

Vite dev server could allow reading files from the Vite project root by bypassing server.fs.deny with double forward-slash paths //. This affects exposed dev servers only. id: CVE-2023-34092 info: name: Vite Dev Server - Information Exposure author: ritikchaddha severity: high description: | Vite...

Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...

Vite dev server - Cross-Site Scripting

Vite's dev server, when used with appType: 'custom' and manually invoking server.transformIndexHtml using the unmodified request URL, is vulnerable to XSS via a crafted URL payload. If the HTML being served includes an inline module script ..., an attacker can inject a script via the URL,...

Vite Development Server - Path Traversal

Path traversal vulnerability in Vite development server's @fs endpoint allows attackers to access files outside the intended directory. When exposed to the network, attackers can exploit this via crafted URLs to access sensitive system files. id: CVE-2025-31125 info: name: Vite Development Server...

Vite Dev Server - Information Exposure

Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...

Vite Dev Server - Path Traversal

Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the server.fs settings. Only apps that explicitly expose the Vite dev server to the network using --host or...

CVE-2025-55182-poc

CVE-2025-55182 React Flight protocol vulnerability allowing prototype chain traversal via chunk references. Testing against bullshit-react-project. Detection This is slightly out of date as the real PoC has now been revealed. Vite RSC : bash ./vite-detect.sh https://example.com Next.js : bash...

CVE-2025-30208-ViteVulnScanner

CVE-2025-30208-ViteVulnScanner Yo, this is a dope multi-threaded Python script by keklick1337 to hunt down domains vulnerable to CVE-2025-30208 in Vite. Basically, it checks if you can snag random files via the @fs endpoint with ?raw?? or ?import&raw?? — think /etc/passwd leaks and other juicy...

ViteVulScan

ViteVulScan Vulnerability Introduction This project covers 3 vulnerabilities: CVE-2025-30208, CVE-2025-31125, CVE-2025-31486. All are arbitrary file reading vulnerabilities in the Vite development server. These three vulnerabilities have broad coverage and are easy to exploit without restrictions...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Vulnerability Overview CVE-2025-30208, CVE-2025-31125 and CVE-2025-31486 are arbitrary file reading vulnerabilities in the Vite development server. These vulnerabilities allow an attacker to bypass access controls through specific URL parameters...