Actively exploited vulnerabilities affecting Vite products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2025-31125https://wildfortech.com/security#CVE-2025-31125This flaw in Vite's development server allows attackers to read files that should be inaccessible by appending specially crafted query parameters such as ?inline&import or ?raw?import to requests. If your team runs Vite's dev server exposed to a network — via the --host flag or server.host configuration — arbitrary files on the host could be read by anyone who can reach that server. Production builds are not affected, but exposed dev environments present a real data-exposure risk.Thu, 22 Jan 2026 00:00:00 GMTViteVitejs