CVE-2025-59427 json
Cloudflare vite plugin exposes secrets over the built-in dev server
published 2025-07-08 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-29441 , GHSA-4pfg-2mw5-f8jx
- cvss
- 2.9
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as .env and .dev.vars. This vulnerability is fixed in 1.6.0.
Patch / fix
- npm @cloudflare/vite-plugin 1.6.0
- cloudflare vite-plugin 1.6.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 13 mo ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA | 4.0 | 2.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @cloudflare/vite-plugin | <1.6.0 |
1.6.0 |
Affected products
- cloudflare workers-sdk
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/cloudflare/workers-sdk/commit/0e500720bf70016fa4ea21fc8959c4bd764ebc38
web
-
github.com
/cloudflare/workers-sdk/security/advisories/GHSA-4pfg-2mw5-f8jx
web
-
hackerone.com
/reports/3117837
web
-
github.com
/cloudflare/workers-sdk/discussions/3455#discussioncomment-6165773
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-59427
advisory
-
github.com
/cloudflare/workers-sdk
package
Sources
- CVE List CVE-2025-59427
- GitHub Advisory GHSA-4pfg-2mw5-f8jx
- NVD CVE-2025-59427
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.