Vite Frontend Framework Vulnerability in JavaScript Applications

CVE-2025-46565

Summary

A vulnerability in the Vite frontend framework allows unauthorized access to certain files in the project root directory. This issue can be exploited if the Vite development server is intentionally exposed to the network using the '--host' or 'server.host' configuration options. Files that are normally restricted by matching patterns, such as sensitive configuration files (.env, .env.*, *.{crt,pem}), can be accessed due to a misconfiguration in pattern matching that stems from using a combination of slashes and dots. This vulnerability has been addressed and patched in subsequent releases, ensuring better safeguarding against unauthorized file access.

References