¡¾Îó²îͨ¸æ¡¿Vite í§ÒâÎļþ¶ÁÈ¡Îó²î(CVE-2025-31125)

Ðû²¼Ê±¼ä 2025-04-01

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

Vite í§ÒâÎļþ¶ÁÈ¡Îó²î

CVE   ID

CVE-2025-31125

Îó²îÀàÐÍ

ÐÅϢй¶

·¢Ã÷ʱ¼ä

2025-04-01

Îó²îÆÀ·Ö

5.3

Îó²îÆ·¼¶

ÖÐΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ʹÓÃÄѶÈ

¸ß

Óû§½»»¥

ÐèÒª

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


ViteÊÇÒ»¸öÏÖ´ú»¯µÄÇ°¶Ë¹¹½¨¹¤¾ß£¬£¬£¬£¬£¬£¬Ö¼ÔÚÌṩ¸ü¿ìµÄ¿ª·¢ÌåÑé¡£¡£¡£¡£Ëüͨ¹ý»ùÓÚÔ­ÉúESÄ£¿£¿ £¿£¿éµÄ¿ª·¢Ð§ÀÍÆ÷£¬£¬£¬£¬£¬£¬ÔÚ¿ª·¢Àú³ÌÖÐʵÏÖ¼«ËÙÈȸüУ¨HMR£©¡£¡£¡£¡£ViteÔÚ¹¹½¨Ê±Ê¹ÓÃÁ˸߶ÈÓÅ»¯µÄ´ò°ü¹¤¾ß£¬£¬£¬£¬£¬£¬Èçesbuild£¬£¬£¬£¬£¬£¬¼«´óÌá¸ßÁ˹¹½¨ËÙÂÊ¡£¡£¡£¡£ËüÖ§³Ö¶àÖÖÇ°¶Ë¿ò¼Ü£¨ÈçReact¡¢Vue£©²¢¿ÉÒÔͨ¹ý²å¼þÀ©Õ¹¹¦Ð§¡£¡£¡£¡£ViteµÄÄ¿µÄÊǼò»¯Ç°¶Ë¿ª·¢ÊÂÇéÁ÷£¬£¬£¬£¬£¬£¬²¢ÌáÉý¿ª·¢Ð§ÂÊ¡£¡£¡£¡£


2025Äê4ÔÂ1ÈÕ£¬£¬£¬£¬£¬£¬Z6×ðÁú¿­Ê±¼¯ÍÅVSRC¼à²âµ½ViteÐû²¼µÄÇ徲ͨ¸æ£¬£¬£¬£¬£¬£¬Ö¸³öÔÚÌض¨°æ±¾Öб£´æí§ÒâÎļþ¶ÁÈ¡Îó²î¡£¡£¡£¡£¹¥»÷Õß¿ÉÒÔͨ¹ý?inline&import»ò?raw?import²ÎÊý»ñÈ¡¾­ÓÉbase64±àÂëµÄ·ÇÊÚȨÎļþÄÚÈÝ¡£¡£¡£¡£¸ÃÎó²î½öÔÚ¿ª·¢Ð§ÀÍÆ÷ͨ¹ý--host»òserver.hostÉèÖÃ̻¶ÖÁÍøÂçʱ£¬£¬£¬£¬£¬£¬²Å¿ÉÄܱ»Ê¹Ó㬣¬£¬£¬£¬£¬Îó²îÆÀ·Ö5.3·Ö£¬£¬£¬£¬£¬£¬Îó²î¼¶±ðΪÖÐΣ¡£¡£¡£¡£


¶þ¡¢Ó°Ïì¹æÄ£


6.2.0 <= Vite <= 6.2.3
6.1.0 <= Vite <= 6.1.2
6.0.0 <= Vite <= 6.0.12
5.0.0 <= Vite <= 5.4.15
Vite <= 4.5.10


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑÐû²¼ÐÞ¸´°æ±¾£¬£¬£¬£¬£¬£¬½¨ÒéÊÜÓ°ÏìÓû§¾¡¿ì¸üС£¡£¡£¡£


Vite >= 6.2.4
6.1.3 <= Vite < 6.2.0
6.0.13 <= Vite < 6.1.0
5.4.16 <= Vite < 6.0.0
4.5.11 <= Vite < 5.0.0


ÏÂÔØÁ´½Ó£ºhttps://github.com/vitejs/vite/releases/


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£¡£¡£¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬£¬£¬£¬ïÔ̭ϵͳÎó²î£¬£¬£¬£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£¡£
? ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬£¬£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬£¬£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬£¬£¬£¬£¬ïÔÌ­½«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬£¬£¬£¬£¬ïÔÌ­¹¥»÷Ãæ¡£¡£¡£¡£
? Ê¹ÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£¡£
? ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔ­Ôò£¬£¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£¡£
? ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£¡£


3.4 ²Î¿¼Á´½Ó


https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8
https://github.com/vitejs/vite
https://nvd.nist.gov/vuln/detail/CVE-2025-31125