CVE-2025-24010: medium-severity vulnerability in vitejs vite
Vite allows any websites to send any requests to the development server and read the response
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Vite's development server accepts requests from any website without proper security checks, allowing attackers to send commands to your local development environment and read sensitive responses. This happens because CORS protections are not enabled by default.
The vulnerability stems from misconfigured CORS policies and insufficient Origin header validation on WebSocket connections in Vite's development server. An attacker can exploit this via cross-site requests from any origin to perform arbitrary requests against the dev server and exfiltrate responses, affecting developers during the development phase.
In the same product, most dangerous first.