Which products and versions are affected by CVE-2025-31125?

Affected: Vite (Vitejs) versions >= 6.2.0, >= >= 6.2.0, < 6.2.4; langfuse-2 (chainguard); langfuse-fips-2 (chainguard), among others. The full list is in the CVE brief.

Is CVE-2025-31125 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since May 30, 2025.

Is CVE-2025-31125 in the CISA KEV catalog?

Yes. It was added on Jan 22, 2026 with a federal remediation due date of Feb 12, 2026.

Is there a public exploit for CVE-2025-31125?

Public exploit code is available.

Is there a fix for CVE-2025-31125?

Fixed versions are available, including @seal-security/vite 4.4.11-sp999, langfuse-2 2.95.12-r26, langfuse-fips-2 2.95.12-r28.

How urgently should CVE-2025-31125 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2025-31125

Q: Is CVE-2025-31125 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since May 30, 2025.

Q: Is CVE-2025-31125 in the CISA KEV catalog?

Yes. It was added on Jan 22, 2026 with a federal remediation due date of Feb 12, 2026.

Q: Is there a public exploit for CVE-2025-31125?

Public exploit code is available.

Q: Is there a fix for CVE-2025-31125?

Fixed versions are available, including @seal-security/vite 4.4.11-sp999, langfuse-2 2.95.12-r26, langfuse-fips-2 2.95.12-r28.

Q: How urgently should CVE-2025-31125 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

HighExploitedPublic exploit

Vite has a server.fs.deny bypassed for inline and raw with ?import query

Published Mar 31, 2025 · Updated Sep 10, 2026 · Also known as GHSA-4r4m-qw57-chr8

Key Facts

Patch immediately

CVE-2025-31125 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Vite (Vitejs), langfuse-2 (chainguard), langfuse-fips-2 (chainguard) and 7 more products.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since May 30, 2025. Public exploit code is available.
EPSS estimates a 65% probability of exploitation in the next 30 days.
Fixed versions are available, including @seal-security/vite 4.4.11-sp999, langfuse-2 2.95.12-r26, langfuse-fips-2 2.95.12-r28.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (30-day exploit likelihood)

65%

Higher than 99.2% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2025-31125 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CISA KEV	Jan 22, 2026	Feb 12, 2026	Not reported
Industry KEV feed	May 30, 2025	Feb 12, 2026	Not reported
CIRCL KEV	Jan 22, 2026	Feb 12, 2026	Not reported
ENISA EUVD	Jan 22, 2026	n/a	Not reported

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Products

14 affected entries in total

Product	Affected versions	Fixed in
ViteVitejs	>= 6.2.0, >= >= 6.2.0, < 6.2.4	4.5.11
langfuse-2chainguard	See advisory	2.95.12-r26
langfuse-fips-2chainguard	See advisory	2.95.12-r28
vitess-18.0chainguard	See advisory	18.0.8-r10
vitess-19.0chainguard	See advisory	19.0.10-r5

5 more affected products in the full CVE brief

Patched Releases

@seal-security/vite

4.4.11-sp999

langfuse-2

2.95.12-r26

langfuse-fips-2

2.95.12-r28

trigger-dev

4.5.11-r1

Vite

>=6.2.4, 4.4.11-sp999, 4.5.11, 5.4.16, 6.0.13, 6.1.3, 6.2.4

vitess-18.0

18.0.8-r10

vitess-19.0

19.0.10-r5

vitess-20.0

20.0.6-r6

vitess-21.0

21.0.3-r5

Timeline

Publicly disclosed
Mar 31, 2025
Added to Industry KEV feed
May 30, 2025
Added to CISA KEV
Jan 22, 2026
Added to CIRCL KEV
Jan 22, 2026
Added to ENISA EUVD
Jan 22, 2026
Last updated
Sep 10, 2026

Weakness Type

CWE-73 External Control of File Name or Path
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-284 Improper Access Control

References

advisoryGHSA advisory
advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31125.json
advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2025-31125
exploitVulnCheck exploitation report
exploitVulnCheck exploitation report

6 more references in the full CVE brief

FAQ

Common Questions.

Vite is a frontend tooling framework for javascript.
Affected: Vite (Vitejs) versions >= 6.2.0, >= >= 6.2.0, < 6.2.4; langfuse-2 (chainguard); langfuse-fips-2 (chainguard), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since May 30, 2025.
Yes. It was added on Jan 22, 2026 with a federal remediation due date of Feb 12, 2026.
Public exploit code is available.
Fixed versions are available, including @seal-security/vite 4.4.11-sp999, langfuse-2 2.95.12-r26, langfuse-fips-2 2.95.12-r28.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2025-31125 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.