Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Cloudflare Vite plugin reveals secret files on local dev server

CVE-2025-59427 · published 1 year ago
Summary

When the Cloudflare Vite plugin is used with its default settings, the local development server makes every file in the project folder publicly accessible, including hidden files that often contain passwords or API keys such as .env and .dev.vars. This could allow anyone with access to the dev server to see sensitive information. Upgrade the plugin to version 1.6.0 or change the configuration to restrict which files are served.

What to do
  • Update cloudflare vite-plugin to version 1.6.0.
Affected software
Ecosystem VendorProductAffected versions
npm cloudflare vite-plugin < 1.6.0
Fix: upgrade to 1.6.0
Original advisory text
Cloudflare vite plugin exposes secrets over the built-in dev server
The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as .env and .dev.vars. This vulnerability is fixed in 1.6.0.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published19 Sep 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-4pfg-2mw5-f8jx · GHSA
CVE-2025-59427 · NVD
CVE-2025-59427 · OSV
Track software like this
Free during beta