CVE-2025-24010

PoC —

CVSS 3.1

6.5 medium

EPSS

<1%p22

Published

Jan 20, 2025 (Jan 20, 2025)

Modified

Jun 17, 2026

Description

Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6.

Vendors: vitejs
Products: vite
Weakness: CWE-346, CWE-350, CWE-1385
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.