Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitl…

CVE-2025-31125 is an improper access control vulnerability in Vite Vitejs that allows unauthorized access to non-allowed files through the ?inline&import or ?raw?import parameters. The vulnerability only affects applications that explicitly expose the Vite development server to the network using --host or server.host configuration options. This is an open-source component vulnerability that could potentially impact multiple products using the Vite development server. The vulnerability has been addressed in a GitHub commit and is documented in the National Vulnerability Database.