Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🟠 Vite (#Windows), Access Restriction Bypass, #CVE-2025-62522 (Medium) -DC-Jun2026-407 https://dailycve.com/vite-windows-access-restriction-bypass-cve-2025-62522-medium-dc-jun2026-407/
Post summary
The text provides a basic disclosure of CVE‑2025‑62522 with a medium severity rating and an access restriction bypass flaw, but offers no PoC, exploit code, active exploitation, or patch details.