CVE-2025-30208

Chino | Inglés Escáner de Vulnerabilidades del Servidor de Desarrollo Vite Un escáner automatizado para redes internas y externas Una herramienta automatizada para escanear vulnerabilidades del servidor de desarrollo de Vite. Esta herramienta utiliza la API de FOFA para recopilar objetivos...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Resumen de vulnerabilidades CVE-2025-30208, CVE-2025-31125 y CVE-2025-31486 son vulnerabilidades de lectura arbitraria de archivos en el servidor de desarrollo de Vite. Estas vulnerabilidades permiten a un atacante eludir los controles de acceso...

Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...

Vite Dev Server - Information Exposure

Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...

CVE-2025-30208-EXP

CVE-2025-30208-EXP Vulnerabilidad de lectura arbitraria de archivos en el servidor de desarrollo Vite CVE-2025-30208, con amplia cobertura, explotación simple y sin restricciones, ¡causando un gran daño! Sentencia de reconocimiento Fofa: root@kitploit: body="/@vite/client" Sentencia de...

CVE-2025-30208

CVE-2025-30208 Usando una cadena de consulta de importación raw especial en un servidor de desarrollo de Vite, un atacante puede leer archivos arbitrarios Resumen del CVE Los servidores de desarrollo de Vite anteriores a 6.2.3, 6.1.2, 6.0.12, 5.4.15 y 4.5.10 pueden eludir las comprobaciones de...

CVE-2026-39363

CVE-2026-39363 — Detección masiva de lectura arbitraria de archivos en Vite Dev Server WebSocket Descargo de responsabilidad: Esta herramienta está destinada únicamente a pruebas de seguridad autorizadas e investigación educativa. Los usuarios deben cumplir con las leyes y regulaciones locales;...

CVE-2026-39363

CVE-2026-39363 — PoC de lectura arbitraria de archivos en Vite Dev Server PoC ejecutable directamente para GHSA-p9ff-h696-f583. A través de un WebSocket HMR sin autenticación, invoca fetchModule, eludiendo la restricción server.fs.allow de la capa HTTP, para leer archivos arbitrarios en la máquin...

EUVD-2026-69705

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock...

CVE-2025-30208

🔥 Escáner de Vulnerabilidad del Servidor de Desarrollo Vite CVE-2025-30208 🚀 Descripción general Esta herramienta escanea en busca de CVE-2025-30208, una vulnerabilidad en el Servidor de Desarrollo de Vite. Permite a los investigadores de seguridad detectar rápidamente instancias vulnerables...

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...

CVE-2026-53571

Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as...

PT-2026-49574

Name of the Vulnerable Software and Affected Versions Vite versions prior to 8.0.16 Vite versions prior to 7.3.5 Vite versions prior to 6.4.3 Description On Windows, the development server fails to correctly normalize NTFS Alternate Data Streams ADS path forms and 8.3 short name compatibility pat...

VulnCheck KEV: CVE-2026-39365

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the...

Sensitive Information Disclosure

Vite is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper enforcement of file access restrictions in the dev server, which allows an attacker to bypass deny rules using crafted query parameters and access sensitive files...

Exploit for CVE-2026-39363

CVE-2026-39363 Vite Dev Server WebSocket Arbitrary File Read...

CVE-2026-39363

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?r...

CVE-2026-39365

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the...

CVE-2026-39365

Vite Dev Server path traversal in optimized dependencies .map handling affects versions prior to 6.4.2, 7.3.2, and 8.0.5. The server resolves file paths via normalizePath(path.resolve(root, url.slice(1))) and calls readFile without restricting ../ segments, allowing retrieval of .map files outsid...

CVE-2026-39364

Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny e.g., .env, .crt can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are...