CVE-2025-58751

Отчет

Red Hat Customers should be aware that the underlying vulnerability originates in the sirv package, which is responsible for serving static files. Vite uses sirv internally to serve content during development, which means projects using Vite were also exposed to the issue. While sirv is technically the component containing the flaw, the upstream Vite project issued the CVE/advisory because the impact was most visible and widespread through Vite’s ecosystem. In practice, this means that both direct consumers of sirv and Vite users are affected, but the CVE was filed under Vite Project by it's maintainers. This vulnerability is rated Low severity because exploitation requires several specific conditions: the Vite dev server must be exposed to the network (via --host or server.host), the application must use the public directory feature, and a symlink must exist inside that public directory to point to the target. These conditions make exploitation unlikely in typical production environments, and the impact is limited to disclosure of files outside the intended directory. The vulnerability does not permit code execution, file modification, or denial of service.

Меры по смягчению последствий

• Avoid exposing the Vite dev server (--host / server.host) to untrusted networks.
• Do not allow symlinks inside the public directory that reference files outside of it.