CVE-2025-59427 - CVE House
Back to Database
Status published Low CVE-2025-59427

Cloudflare vite plugin exposes secrets over the built-in dev server

Vulnerability Description

The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as .env and .dev.vars. This vulnerability is fixed in 1.6.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59427

Credits & Attribution

No credits recorded in the NVD database.

References

Affected Vendor

Affected Software

workers-sdk
Vulnerable Versions:
< 1.6.0

Timeline

Official Publish: September 19th, 2025
Last Modified: September 19th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration