CVE-2025-24010

Published: Jan 20, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6.

Affected (3)

Products: Vitejs: Vite

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Vitejs Vite	Before 4.5.5
Vitejs Vite	From 5.0.0 to 5.4.12
Vitejs Vite	From 6.0.0 to 6.0.9

Related CWEs

Missing Origin Validation in WebSockets

The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

Reliance on Reverse DNS Resolution for a Security-Critical Action

The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.

References (1)

https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6

Source: security-advisories@github.com

ExploitMitigationThird Party Advisory

Timeline

No history available yet.