CVE-2025-30208

Vite dev servers in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fail to enforce the `@fs` file-access allow list because trailing separators such as `?` are stripped in several places but are not accounted for in the query-string regexes. A remote, unauthenticated attacker triggers the flaw by appending `?raw??` or `?import&raw??` to a dev-server URL, bypassing the restriction and returning the contents of arbitrary files on the host if they exist. The impact is confidentiality only — arbitrary file read with no code execution or privilege escalation, consistent with the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Only projects that explicitly expose the Vite dev server to the network (via `--host` or the `server.host` config option) are affected; purely local development usage is not remotely exploitable. A public proof of concept is available in the GitHub advisory (GHSA-x574-m823-4x7w); the flaw is not yet in CISA KEV, but EPSS assigns a 75% probability of exploitation within 30 days (99th percentile), so opportunistic scanning is likely.

What to do: Upgrade Vite to 6.2.3, 6.1.2, 6.0.12, 5.4.15, or 4.5.10 depending on your release branch. If you cannot upgrade immediately, stop exposing the dev server to untrusted networks (remove `--host` / set `server.host` to localhost) or firewall the dev-server port. Audit internet-facing hosts for running Vite dev servers and check access logs for requests containing `?raw??` or `?import&raw??`, which may indicate exploitation attempts.