Critical KEV-listed

CVE-2025-31125

CISA KEV Listing of CVE-2025-31125 in Vite

Vendor / product: vite

Event date: 2026-01-22

Public PoC: Yes

First tracked by RiskWire: 2026-10-11

CISA KEV catalog

Added to KEV

2026-01-22 ↗

Federal remediation due

2026-02-12 (241 days overdue)

Ransomware campaign use

Unknown

CISA description

Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Sources & citations (1)

CISA's KEV catalogue has no RSS feed, so here is one (and which npm, PyPI and Maven packages are on it) dev.to · 2026-10-10

References

View on NVD ↗ View on MITRE CVE ↗ Search CISA ↗ KEV lookup tool

See CVE-2025-31125 in context

RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.

Book a 20-min demo →