¡¾Îó²îͨ¸æ¡¿Vite í§ÒâÎļþ¶ÁÈ¡Îó²î(CVE-2025-31125)

Ðû²¼Ê±¼ä 2025-04-01

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

Vite í§ÒâÎļþ¶ÁÈ¡Îó²î

CVE   ID

CVE-2025-31125

Îó²îÀàÐÍ

ÐÅϢй¶

·¢Ã÷ʱ¼ä

2025-04-01

Îó²îÆÀ·Ö

5.3

Îó²îÆ·¼¶

ÖÐΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ʹÓÃÄѶÈ

¸ß

Óû§½»»¥

ÐèÒª

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


ViteÊÇÒ»¸öÏÖ´ú»¯µÄÇ°¶Ë¹¹½¨¹¤¾ß£¬£¬£¬£¬£¬Ö¼ÔÚÌṩ¸ü¿ìµÄ¿ª·¢ÌåÑé¡£¡£¡£¡£¡£Ëüͨ¹ý»ùÓÚÔ­ÉúESÄ£¿£¿£¿£¿éµÄ¿ª·¢Ð§ÀÍÆ÷£¬£¬£¬£¬£¬ÔÚ¿ª·¢Àú³ÌÖÐʵÏÖ¼«ËÙÈȸüУ¨HMR£©¡£¡£¡£¡£¡£ViteÔÚ¹¹½¨Ê±Ê¹ÓÃÁ˸߶ÈÓÅ»¯µÄ´ò°ü¹¤¾ß£¬£¬£¬£¬£¬Èçesbuild£¬£¬£¬£¬£¬¼«´óÌá¸ßÁ˹¹½¨ËÙÂÊ¡£¡£¡£¡£¡£ËüÖ§³Ö¶àÖÖÇ°¶Ë¿ò¼Ü£¨ÈçReact¡¢Vue£©²¢¿ÉÒÔͨ¹ý²å¼þÀ©Õ¹¹¦Ð§¡£¡£¡£¡£¡£ViteµÄÄ¿µÄÊǼò»¯Ç°¶Ë¿ª·¢ÊÂÇéÁ÷£¬£¬£¬£¬£¬²¢ÌáÉý¿ª·¢Ð§ÂÊ¡£¡£¡£¡£¡£


2025Äê4ÔÂ1ÈÕ£¬£¬£¬£¬£¬¼øºÚµ£±£Íø¼¯ÍÅVSRC¼à²âµ½ViteÐû²¼µÄÇ徲ͨ¸æ£¬£¬£¬£¬£¬Ö¸³öÔÚÌض¨°æ±¾Öб£´æí§ÒâÎļþ¶ÁÈ¡Îó²î¡£¡£¡£¡£¡£¹¥»÷Õß¿ÉÒÔͨ¹ý?inline&import»ò?raw?import²ÎÊý»ñÈ¡¾­ÓÉbase64±àÂëµÄ·ÇÊÚȨÎļþÄÚÈÝ¡£¡£¡£¡£¡£¸ÃÎó²î½öÔÚ¿ª·¢Ð§ÀÍÆ÷ͨ¹ý--host»òserver.hostÉèÖÃ̻¶ÖÁÍøÂçʱ£¬£¬£¬£¬£¬²Å¿ÉÄܱ»Ê¹Ó㬣¬£¬£¬£¬Îó²îÆÀ·Ö5.3·Ö£¬£¬£¬£¬£¬Îó²î¼¶±ðΪÖÐΣ¡£¡£¡£¡£¡£


¶þ¡¢Ó°Ïì¹æÄ£


6.2.0 <= Vite <= 6.2.3
6.1.0 <= Vite <= 6.1.2
6.0.0 <= Vite <= 6.0.12
5.0.0 <= Vite <= 5.4.15
Vite <= 4.5.10


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑÐû²¼ÐÞ¸´°æ±¾£¬£¬£¬£¬£¬½¨ÒéÊÜÓ°ÏìÓû§¾¡¿ì¸üС£¡£¡£¡£¡£


Vite >= 6.2.4
6.1.3 <= Vite < 6.2.0
6.0.13 <= Vite < 6.1.0
5.4.16 <= Vite < 6.0.0
4.5.11 <= Vite < 5.0.0


ÏÂÔØÁ´½Ó£ºhttps://github.com/vitejs/vite/releases/


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£¡£¡£¡£¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬£¬£¬ïÔ̭ϵͳÎó²î£¬£¬£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£¡£¡£
? ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬£¬£¬£¬ïÔÌ­½«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬£¬£¬£¬ïÔÌ­¹¥»÷Ãæ¡£¡£¡£¡£¡£
? Ê¹ÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£¡£¡£
? ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔ­Ôò£¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£¡£¡£
? ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£¡£¡£


3.4 ²Î¿¼Á´½Ó


https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8
https://github.com/vitejs/vite
https://nvd.nist.gov/vuln/detail/CVE-2025-31125