VulnerabilityAnalyzed

CVE-2025-24010

Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections.

MEDIUM 6.5EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS: 0.29% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-346, CWE-350, CWE-1385
Affected: vitejs/vite
Source: security-advisories@github.com

References

https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6Exploit, Mitigation, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.