¡¾Îó²îͨ¸æ¡¿Vite í§ÒâÎļþ¶ÁÈ¡Îó²î(CVE-2025-31486)

Ðû²¼Ê±¼ä 2025-04-07

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

Vite í§ÒâÎļþ¶ÁÈ¡Îó²î

CVE   ID

CVE-2025-31486

Îó²îÀàÐÍ

ÐÅϢй¶

·¢Ã÷ʱ¼ä

2025-04-07

Îó²îÆÀ·Ö

5.3

Îó²îÆ·¼¶

ÖÐΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ʹÓÃÄѶÈ

¸ß

Óû§½»»¥

ÐèÒª

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


ViteÊÇÒ»¸öÏÖ´ú»¯µÄÇ°¶Ë¹¹½¨¹¤¾ß£¬£¬£¬£¬£¬£¬Ö¼ÔÚÌṩ¸ü¿ìµÄ¿ª·¢ÌåÑé¡£¡£¡£Ëüͨ¹ý»ùÓÚÔ­ÉúESÄ£¿ £¿£¿£¿éµÄ¿ª·¢Ð§ÀÍÆ÷£¬£¬£¬£¬£¬£¬ÔÚ¿ª·¢Àú³ÌÖÐʵÏÖ¼«ËÙÈȸüУ¨HMR£©¡£¡£¡£ViteÔÚ¹¹½¨Ê±Ê¹ÓÃÁ˸߶ÈÓÅ»¯µÄ´ò°ü¹¤¾ß£¬£¬£¬£¬£¬£¬Èçesbuild£¬£¬£¬£¬£¬£¬¼«´óÌá¸ßÁ˹¹½¨ËÙÂÊ¡£¡£¡£ËüÖ§³Ö¶àÖÖÇ°¶Ë¿ò¼Ü£¨ÈçReact¡¢Vue£©²¢¿ÉÒÔͨ¹ý²å¼þÀ©Õ¹¹¦Ð§¡£¡£¡£ViteµÄÄ¿µÄÊǼò»¯Ç°¶Ë¿ª·¢ÊÂÇéÁ÷£¬£¬£¬£¬£¬£¬²¢ÌáÉý¿ª·¢Ð§ÂÊ¡£¡£¡£


2025Äê4ÔÂ7ÈÕ£¬£¬£¬£¬£¬£¬ÄϹ¬NGÓéÀÖ¼¯ÍÅVSRC¼à²âµ½ViteÐû²¼µÄÇ徲ͨ¸æ£¬£¬£¬£¬£¬£¬Ö¸³öÔÚÌض¨°æ±¾Öб£´æí§ÒâÎļþ¶ÁÈ¡Îó²î¡£¡£¡£ÔÊÐí¹¥»÷Õßͨ¹ý½á¹¹Ìض¨µÄÇëÇ󷾶£¨ÈçÐÞ¸ÄΪ .svg ÎļþÀ©Õ¹Ãû²¢Á¬ÏµÆäËû²ÎÊý£©ÈƹýÎļþ»á¼ûÏÞÖÆ£¬£¬£¬£¬£¬£¬Ì»Â¶í§ÒâÎļþµÄÄÚÈÝ£¬£¬£¬£¬£¬£¬¿ÉÄܵ¼ÖÂÃô¸ÐÐÅϢй¶¡£¡£¡£¸ÃÎó²î½öÔÚ¿ª·¢Ð§ÀÍÆ÷ͨ¹ý--host»òserver.hostÉèÖÃ̻¶ÖÁÍøÂçʱ£¬£¬£¬£¬£¬£¬²Å¿ÉÄܱ»Ê¹Ó㬣¬£¬£¬£¬£¬Îó²îÆÀ·Ö5.3·Ö£¬£¬£¬£¬£¬£¬Îó²î¼¶±ðΪÖÐΣ¡£¡£¡£


¶þ¡¢Ó°Ïì¹æÄ£


6.2.0 <= Vite <= 6.2.4
6.1.0 <= Vite <= 6.1.3
6.0.0 <= Vite <= 6.0.13
5.0.0 <= Vite <= 5.4.16
Vite <= 4.5.11


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑÐû²¼ÐÞ¸´°æ±¾£¬£¬£¬£¬£¬£¬½¨ÒéÊÜÓ°ÏìÓû§¾¡¿ì¸üС£¡£¡£
Vite >= 6.2.5
6.1.4 <= Vite < 6.2.0
6.0.14 <= Vite < 6.1.0
5.4.17 <= Vite < 6.0.0
4.5.12 <= Vite < 5.0.0


ÏÂÔØÁ´½Ó£ºhttps://github.com/vitejs/vite/releases/


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£¡£¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¡£¡£¬£¬£¬£¬£¬£¬ïÔ̭ϵͳÎó²î£¬£¬£¬£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£
? ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬£¬£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬£¬£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬£¬£¬£¬£¬ïÔÌ­½«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬£¬£¬£¬£¬ïÔÌ­¹¥»÷Ãæ¡£¡£¡£
? Ê¹ÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£
? ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔ­Ôò£¬£¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£
? ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£


3.4 ²Î¿¼Á´½Ó


https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
https://nvd.nist.gov/vuln/detail/CVE-2025-31486