CVE-2025-24010

Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6.

• CWE-346
• CWE-350
• CWE-1385

• https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6Exploit, Mitigation, Third Party Advisory

Published

Jan 20, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-24005A local attacker with a local user account can leverage a vu…7.8
• CVE-2025-24006A low privileged local attacker can leverage insecure permis…7.8
• CVE-2025-24007A vulnerability has been identified in SIRIUS 3RK3 Modular S…8.7
• CVE-2025-24008A vulnerability has been identified in SIRIUS 3RK3 Modular S…8.7
• CVE-2025-24009A vulnerability has been identified in SIRIUS 3RK3 Modular S…8.2
• CVE-2025-2401Buffer overflow vulnerability in Immunity Debugger affecting…5.4
• CVE-2025-24011Umbraco is a free and open source .NET content management sy…5.3
• CVE-2025-24012Umbraco is a free and open source .NET content management sy…5.4
• CVE-2025-24013CodeIgniter is a PHP full-stack web framework. Prior to 4.5.…5.3
• CVE-2025-24014Vim is an open source, command line text editor. A segmentat…5.5
• CVE-2025-24015Deno is a JavaScript, TypeScript, and WebAssembly runtime. V…5.3
• CVE-2025-24016Wazuh is a free and open source platform used for threat pre…9.9