Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2025-24010

Vite allows any websites to send any requests to the development server and read the response

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

vitejs vite

  • >= 6.0.0, < 6.0.9affected
  • >= 5.0.0, < 5.4.12affected
  • < 4.5.6affected

References