Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2025-24010 — MEDIUM severity vulnerability | Release Alert

CVE-2025-24010

6.5

MEDIUMCVSS v3

Published

January 20, 2025

Affected

9 projects

Assigned by

GitHub

Severity scale

010

Description

Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6.

NPMNative-ESM powered web dev build tool

< 4.5.5, >= 5.0.0, < 5.4.12, >= 6.0.0, < 6.0.9NVD

GitHubNext generation frontend tooling. It's fast!

< 4.5.5, >= 5.0.0, < 5.4.12, >= 6.0.0, < 6.0.9NVD

NPM

More on this CVE

NVD↗GitHub Advisory↗

The Vite plugin for UnoCSS

< 4.5.5, >= 5.0.0, < 5.4.12, >= 6.0.0, < 6.0.9NVD

GitHub⚡ Vite Experience with Nuxt 2

< 4.5.5, >= 5.0.0, < 5.4.12, >= 6.0.0, < 6.0.9NVD

NPMNative-ESM powered web dev build tool

< 4.5.5, >= 5.0.0, < 5.4.12, >= 6.0.0, < 6.0.9NVD

Python Package IndexA simple and minimal static site generator.

< 4.5.5, >= 5.0.0, < 5.4.12, >= 6.0.0, < 6.0.9NVD

Crates.ioVite

< 4.5.5, >= 5.0.0, < 5.4.12, >= 6.0.0, < 6.0.9NVD

GitHub:cyclone: a static site generator that Just Works™; powers https://icyphox.sh

< 4.5.5, >= 5.0.0, < 5.4.12, >= 6.0.0, < 6.0.9NVD

@tailwindcss/vite

NPMA utility-first CSS framework for rapidly building custom user interfaces.

< 4.5.5, >= 5.0.0, < 5.4.12, >= 6.0.0, < 6.0.9NVD