¡¾Îó²îͨ¸æ¡¿Vite í§ÒâÎļþ¶ÁÈ¡Îó²î(CVE-2025-31486)

Ðû²¼Ê±¼ä 2025-04-07

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

Vite í§ÒâÎļþ¶ÁÈ¡Îó²î

CVE   ID

CVE-2025-31486

Îó²îÀàÐÍ

ÐÅϢй¶

·¢Ã÷ʱ¼ä

2025-04-07

Îó²îÆÀ·Ö

5.3

Îó²îÆ·¼¶

ÖÐΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ʹÓÃÄѶÈ

¸ß

Óû§½»»¥

ÐèÒª

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


ViteÊÇÒ»¸öÏÖ´ú»¯µÄÇ°¶Ë¹¹½¨¹¤¾ß£¬Ö¼ÔÚÌṩ¸ü¿ìµÄ¿ª·¢ÌåÑé¡£Ëüͨ¹ý»ùÓÚÔ­ÉúESÄ£¿éµÄ¿ª·¢·þÎñÆ÷£¬ÔÚ¿ª·¢Àú³ÌÖÐʵÏÖ¼«ËÙÈȸüУ¨HMR£©¡£ViteÔÚ¹¹½¨Ê±Ê¹ÓÃÁ˸߶ÈÓÅ»¯µÄ´ò°ü¹¤¾ß£¬Èçesbuild£¬¼«´óÌá¸ßÁ˹¹½¨ËÙÂÊ¡£ËüÖ§³Ö¶àÖÖÇ°¶Ë¿ò¼Ü£¨ÈçReact¡¢Vue£©²¢¿ÉÒÔͨ¹ý²å¼þÀ©Õ¹¹¦Ð§¡£ViteµÄÄ¿µÄÊǼò»¯Ç°¶Ë¿ª·¢ÊÂÇéÁ÷£¬²¢ÌáÉý¿ª·¢Ð§ÂÊ¡£


2025Äê4ÔÂ7ÈÕ£¬×ðÁú¿­Ê±¼¯ÍÅVSRC¼à²âµ½ViteÐû²¼µÄÇ徲ͨ¸æ£¬Ö¸³öÔÚÌض¨°æ±¾Öб£´æí§ÒâÎļþ¶ÁÈ¡Îó²î¡£ÔÊÐí¹¥»÷Õßͨ¹ý½á¹¹Ìض¨µÄÇëÇ󷾶£¨ÈçÐÞ¸ÄΪ .svg ÎļþÀ©Õ¹Ãû²¢ÍŽáÆäËû²ÎÊý£©ÈƹýÎļþ»á¼ûÏÞÖÆ£¬Ì»Â¶í§ÒâÎļþµÄÄÚÈÝ£¬¿ÉÄܵ¼ÖÂÃô¸ÐÐÅϢй¶¡£¸ÃÎó²î½öÔÚ¿ª·¢·þÎñÆ÷ͨ¹ý--host»òserver.hostÉèÖÃ̻¶ÖÁÍøÂçʱ£¬²Å¿ÉÄܱ»Ê¹Óã¬Îó²îÆÀ·Ö5.3·Ö£¬Îó²î¼¶±ðΪÖÐΣ¡£


¶þ¡¢Ó°Ïì¹æÄ£


6.2.0 <= Vite <= 6.2.4
6.1.0 <= Vite <= 6.1.3
6.0.0 <= Vite <= 6.0.13
5.0.0 <= Vite <= 5.4.16
Vite <= 4.5.11


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑÐû²¼ÐÞ¸´°æ±¾£¬½¨ÒéÊÜÓ°ÏìÓû§¾¡¿ì¸üС£
Vite >= 6.2.5
6.1.4 <= Vite < 6.2.0
6.0.14 <= Vite < 6.1.0
5.4.17 <= Vite < 6.0.0
4.5.12 <= Vite < 5.0.0


ÏÂÔØÁ´½Ó£ºhttps://github.com/vitejs/vite/releases/


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬ïÔ̭ϵͳÎó²î£¬ÌáÉý·þÎñÆ÷µÄÇå¾²ÐÔ¡£
? ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬Ð޸ķÀ»ðǽսÂÔ£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬ïÔÌ­½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬ïÔÌ­¹¥»÷Ãæ¡£
? Ê¹ÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£
? ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔ­Ôò£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£
? ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£


3.4 ²Î¿¼Á´½Ó


https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
https://nvd.nist.gov/vuln/detail/CVE-2025-31486