Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
10 vulnerabilities found for vitest by vitest-dev
CVE-2026-53633 (GCVE-0-2026-53633)
Vulnerability from nvd – Published: 2026-07-14 19:35 – Updated: 2026-07-16 03:55
VLAI
EPSS
VEX
Title
Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Summary
Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/vitest-dev/vitest/security/adv… | x_refsource_CONFIRM |
| https://github.com/vitest-dev/vitest/pull/10444 | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/pull/10450 | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/pull/10456 | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/commit/385a1… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/commit/63e3b… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/commit/e4067… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/releases/tag… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/releases/tag… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vitest-dev | vitest |
Affected:
>= 3.0.0, < 3.2.5
Affected: >= 4.0.0, < 4.1.8 Affected: >= 5.0.0-beta.0, < 5.0.0-beta.4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53633",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T03:55:25.715Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vitest",
"vendor": "vitest-dev",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.2.5"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.1.8"
},
{
"status": "affected",
"version": "\u003e= 5.0.0-beta.0, \u003c 5.0.0-beta.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T19:35:42.739Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm"
},
{
"name": "https://github.com/vitest-dev/vitest/pull/10444",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/pull/10444"
},
{
"name": "https://github.com/vitest-dev/vitest/pull/10450",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/pull/10450"
},
{
"name": "https://github.com/vitest-dev/vitest/pull/10456",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/pull/10456"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/63e3b2eee4d58da56786a6333f517b9b492528c7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/63e3b2eee4d58da56786a6333f517b9b492528c7"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9"
},
{
"name": "https://github.com/vitest-dev/vitest/releases/tag/v3.2.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/releases/tag/v3.2.5"
},
{
"name": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.8"
},
{
"name": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.4"
}
],
"source": {
"advisory": "GHSA-g8mr-85jm-7xhm",
"discovery": "UNKNOWN"
},
"title": "Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53633",
"datePublished": "2026-07-14T19:35:42.739Z",
"dateReserved": "2026-06-09T20:16:59.647Z",
"dateUpdated": "2026-07-16T03:55:25.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47429 (GCVE-0-2026-47429)
Vulnerability from nvd – Published: 2026-07-14 19:28 – Updated: 2026-07-21 15:02
VLAI
EPSS
VEX
Title
Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
Summary
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/vitest-dev/vitest/security/adv… | x_refsource_CONFIRM |
| https://github.com/vitest-dev/vitest/pull/10445 | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/pull/9350 | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/commit/20e00… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/commit/af88b… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/releases/tag… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vitest-dev | vitest |
Affected:
< 3.2.5
Affected: >= 4.0.0, < 4.1.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47429",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T15:02:06.439415Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T15:02:17.187Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vitest",
"vendor": "vitest-dev",
"versions": [
{
"status": "affected",
"version": "\u003c 3.2.5"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\\\?\\\\..\\\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T19:28:08.688Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp"
},
{
"name": "https://github.com/vitest-dev/vitest/pull/10445",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/pull/10445"
},
{
"name": "https://github.com/vitest-dev/vitest/pull/9350",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/pull/9350"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8"
},
{
"name": "https://github.com/vitest-dev/vitest/releases/tag/v3.2.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/releases/tag/v3.2.5"
},
{
"name": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.0"
}
],
"source": {
"advisory": "GHSA-5xrq-8626-4rwp",
"discovery": "UNKNOWN"
},
"title": "Vitest: Arbitrary file can be read and executed when Vitest UI server is listening"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47429",
"datePublished": "2026-07-14T19:28:08.688Z",
"dateReserved": "2026-05-19T19:37:43.527Z",
"dateUpdated": "2026-07-21T15:02:17.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47428 (GCVE-0-2026-47428)
Vulnerability from nvd – Published: 2026-07-14 19:30 – Updated: 2026-07-15 13:20
VLAI
EPSS
VEX
Title
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
Summary
Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.
Severity
9.6 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/vitest-dev/vitest/security/adv… | x_refsource_CONFIRM |
| https://github.com/vitest-dev/vitest/pull/10283 | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/pull/10285 | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/commit/18af9… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/commit/3514f… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/releases/tag… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vitest-dev | vitest |
Affected:
>= 4.0.17, < 4.1.6
Affected: >= 5.0.0-beta.0, < 5.0.0-beta.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47428",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T13:20:10.196813Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T13:20:14.275Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vitest",
"vendor": "vitest-dev",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.17, \u003c 4.1.6"
},
{
"status": "affected",
"version": "\u003e= 5.0.0-beta.0, \u003c 5.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T19:30:19.670Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp"
},
{
"name": "https://github.com/vitest-dev/vitest/pull/10283",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/pull/10283"
},
{
"name": "https://github.com/vitest-dev/vitest/pull/10285",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/pull/10285"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa"
},
{
"name": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.6"
},
{
"name": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3"
}
],
"source": {
"advisory": "GHSA-2h32-95rg-cppp",
"discovery": "UNKNOWN"
},
"title": "Vitest browser mode serves unsanitized otelCarrier query parameter as inline script"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47428",
"datePublished": "2026-07-14T19:30:19.670Z",
"dateReserved": "2026-05-19T19:37:43.527Z",
"dateUpdated": "2026-07-15T13:20:14.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-24964 (GCVE-0-2025-24964)
Vulnerability from nvd – Published: 2025-02-04 19:36 – Updated: 2025-02-12 20:51
VLAI
EPSS
VEX
Title
Remote Code Execution when accessing a malicious website while Vitest API server is listening
Summary
Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
9.7 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1385 - Missing Origin Validation in WebSockets
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/vitest-dev/vitest/security/adv… | x_refsource_CONFIRM |
| https://github.com/vitest-dev/vitest/blob/9a581e1… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/blob/9a581e1… | x_refsource_MISC |
| https://vitest.dev/config/#api | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vitest-dev | vitest |
Affected:
<= 0.0.125
Affected: >= 1.0.0, < 1.6.1 Affected: >= 2.0.0, < 2.1.9 Affected: >= 3.0.0, < 3.0.5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24964",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-04T19:45:47.197801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-12T20:51:28.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vitest",
"vendor": "vitest-dev",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.0.125"
},
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.6.1"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2.1.9"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.0.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.7,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1385",
"description": "CWE-1385: Missing Origin Validation in WebSockets",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-04T19:36:50.509Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq"
},
{
"name": "https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46"
},
{
"name": "https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76"
},
{
"name": "https://vitest.dev/config/#api",
"tags": [
"x_refsource_MISC"
],
"url": "https://vitest.dev/config/#api"
}
],
"source": {
"advisory": "GHSA-9crc-q9x8-hgqq",
"discovery": "UNKNOWN"
},
"title": "Remote Code Execution when accessing a malicious website while Vitest API server is listening"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-24964",
"datePublished": "2025-02-04T19:36:50.509Z",
"dateReserved": "2025-01-29T15:18:03.209Z",
"dateUpdated": "2025-02-12T20:51:28.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-24963 (GCVE-0-2025-24963)
Vulnerability from nvd – Published: 2025-02-04 19:36 – Updated: 2025-02-12 20:51
VLAI
EPSS
VEX
Title
Browser mode serves arbitrary files in vitest
Summary
Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/vitest-dev/vitest/security/adv… | x_refsource_CONFIRM |
| https://github.com/vitest-dev/vitest/commit/2d620… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/blob/f17918a… | x_refsource_MISC |
| https://vitest.dev/guide/browser/config.html#brow… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vitest-dev | vitest |
Affected:
>= 2.0.4, < 2.1.9
Affected: >= 3.0.0, < 3.0.4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24963",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-04T19:44:40.367761Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-12T20:51:28.011Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vitest",
"vendor": "vitest-dev",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.4, \u003c 2.1.9"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.0.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-04T19:36:52.385Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f"
},
{
"name": "https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130"
},
{
"name": "https://vitest.dev/guide/browser/config.html#browser-api",
"tags": [
"x_refsource_MISC"
],
"url": "https://vitest.dev/guide/browser/config.html#browser-api"
}
],
"source": {
"advisory": "GHSA-8gvc-j273-4wm5",
"discovery": "UNKNOWN"
},
"title": "Browser mode serves arbitrary files in vitest"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-24963",
"datePublished": "2025-02-04T19:36:52.385Z",
"dateReserved": "2025-01-29T15:18:03.209Z",
"dateUpdated": "2025-02-12T20:51:28.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-53633 (GCVE-0-2026-53633)
Vulnerability from cvelistv5 – Published: 2026-07-14 19:35 – Updated: 2026-07-16 03:55
VLAI
EPSS
VEX
Title
Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Summary
Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/vitest-dev/vitest/security/adv… | x_refsource_CONFIRM |
| https://github.com/vitest-dev/vitest/pull/10444 | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/pull/10450 | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/pull/10456 | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/commit/385a1… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/commit/63e3b… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/commit/e4067… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/releases/tag… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/releases/tag… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vitest-dev | vitest |
Affected:
>= 3.0.0, < 3.2.5
Affected: >= 4.0.0, < 4.1.8 Affected: >= 5.0.0-beta.0, < 5.0.0-beta.4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53633",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T03:55:25.715Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vitest",
"vendor": "vitest-dev",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.2.5"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.1.8"
},
{
"status": "affected",
"version": "\u003e= 5.0.0-beta.0, \u003c 5.0.0-beta.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T19:35:42.739Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm"
},
{
"name": "https://github.com/vitest-dev/vitest/pull/10444",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/pull/10444"
},
{
"name": "https://github.com/vitest-dev/vitest/pull/10450",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/pull/10450"
},
{
"name": "https://github.com/vitest-dev/vitest/pull/10456",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/pull/10456"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/63e3b2eee4d58da56786a6333f517b9b492528c7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/63e3b2eee4d58da56786a6333f517b9b492528c7"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9"
},
{
"name": "https://github.com/vitest-dev/vitest/releases/tag/v3.2.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/releases/tag/v3.2.5"
},
{
"name": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.8"
},
{
"name": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.4"
}
],
"source": {
"advisory": "GHSA-g8mr-85jm-7xhm",
"discovery": "UNKNOWN"
},
"title": "Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53633",
"datePublished": "2026-07-14T19:35:42.739Z",
"dateReserved": "2026-06-09T20:16:59.647Z",
"dateUpdated": "2026-07-16T03:55:25.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47428 (GCVE-0-2026-47428)
Vulnerability from cvelistv5 – Published: 2026-07-14 19:30 – Updated: 2026-07-15 13:20
VLAI
EPSS
VEX
Title
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
Summary
Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.
Severity
9.6 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/vitest-dev/vitest/security/adv… | x_refsource_CONFIRM |
| https://github.com/vitest-dev/vitest/pull/10283 | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/pull/10285 | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/commit/18af9… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/commit/3514f… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/releases/tag… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vitest-dev | vitest |
Affected:
>= 4.0.17, < 4.1.6
Affected: >= 5.0.0-beta.0, < 5.0.0-beta.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47428",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T13:20:10.196813Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T13:20:14.275Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vitest",
"vendor": "vitest-dev",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.17, \u003c 4.1.6"
},
{
"status": "affected",
"version": "\u003e= 5.0.0-beta.0, \u003c 5.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T19:30:19.670Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp"
},
{
"name": "https://github.com/vitest-dev/vitest/pull/10283",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/pull/10283"
},
{
"name": "https://github.com/vitest-dev/vitest/pull/10285",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/pull/10285"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa"
},
{
"name": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.6"
},
{
"name": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3"
}
],
"source": {
"advisory": "GHSA-2h32-95rg-cppp",
"discovery": "UNKNOWN"
},
"title": "Vitest browser mode serves unsanitized otelCarrier query parameter as inline script"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47428",
"datePublished": "2026-07-14T19:30:19.670Z",
"dateReserved": "2026-05-19T19:37:43.527Z",
"dateUpdated": "2026-07-15T13:20:14.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47429 (GCVE-0-2026-47429)
Vulnerability from cvelistv5 – Published: 2026-07-14 19:28 – Updated: 2026-07-21 15:02
VLAI
EPSS
VEX
Title
Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
Summary
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/vitest-dev/vitest/security/adv… | x_refsource_CONFIRM |
| https://github.com/vitest-dev/vitest/pull/10445 | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/pull/9350 | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/commit/20e00… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/commit/af88b… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/releases/tag… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vitest-dev | vitest |
Affected:
< 3.2.5
Affected: >= 4.0.0, < 4.1.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47429",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T15:02:06.439415Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T15:02:17.187Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vitest",
"vendor": "vitest-dev",
"versions": [
{
"status": "affected",
"version": "\u003c 3.2.5"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\\\?\\\\..\\\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T19:28:08.688Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp"
},
{
"name": "https://github.com/vitest-dev/vitest/pull/10445",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/pull/10445"
},
{
"name": "https://github.com/vitest-dev/vitest/pull/9350",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/pull/9350"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8"
},
{
"name": "https://github.com/vitest-dev/vitest/releases/tag/v3.2.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/releases/tag/v3.2.5"
},
{
"name": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.0"
}
],
"source": {
"advisory": "GHSA-5xrq-8626-4rwp",
"discovery": "UNKNOWN"
},
"title": "Vitest: Arbitrary file can be read and executed when Vitest UI server is listening"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47429",
"datePublished": "2026-07-14T19:28:08.688Z",
"dateReserved": "2026-05-19T19:37:43.527Z",
"dateUpdated": "2026-07-21T15:02:17.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-24963 (GCVE-0-2025-24963)
Vulnerability from cvelistv5 – Published: 2025-02-04 19:36 – Updated: 2025-02-12 20:51
VLAI
EPSS
VEX
Title
Browser mode serves arbitrary files in vitest
Summary
Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/vitest-dev/vitest/security/adv… | x_refsource_CONFIRM |
| https://github.com/vitest-dev/vitest/commit/2d620… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/blob/f17918a… | x_refsource_MISC |
| https://vitest.dev/guide/browser/config.html#brow… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vitest-dev | vitest |
Affected:
>= 2.0.4, < 2.1.9
Affected: >= 3.0.0, < 3.0.4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24963",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-04T19:44:40.367761Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-12T20:51:28.011Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vitest",
"vendor": "vitest-dev",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.4, \u003c 2.1.9"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.0.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-04T19:36:52.385Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5"
},
{
"name": "https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f"
},
{
"name": "https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130"
},
{
"name": "https://vitest.dev/guide/browser/config.html#browser-api",
"tags": [
"x_refsource_MISC"
],
"url": "https://vitest.dev/guide/browser/config.html#browser-api"
}
],
"source": {
"advisory": "GHSA-8gvc-j273-4wm5",
"discovery": "UNKNOWN"
},
"title": "Browser mode serves arbitrary files in vitest"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-24963",
"datePublished": "2025-02-04T19:36:52.385Z",
"dateReserved": "2025-01-29T15:18:03.209Z",
"dateUpdated": "2025-02-12T20:51:28.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-24964 (GCVE-0-2025-24964)
Vulnerability from cvelistv5 – Published: 2025-02-04 19:36 – Updated: 2025-02-12 20:51
VLAI
EPSS
VEX
Title
Remote Code Execution when accessing a malicious website while Vitest API server is listening
Summary
Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
9.7 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1385 - Missing Origin Validation in WebSockets
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/vitest-dev/vitest/security/adv… | x_refsource_CONFIRM |
| https://github.com/vitest-dev/vitest/blob/9a581e1… | x_refsource_MISC |
| https://github.com/vitest-dev/vitest/blob/9a581e1… | x_refsource_MISC |
| https://vitest.dev/config/#api | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vitest-dev | vitest |
Affected:
<= 0.0.125
Affected: >= 1.0.0, < 1.6.1 Affected: >= 2.0.0, < 2.1.9 Affected: >= 3.0.0, < 3.0.5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24964",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-04T19:45:47.197801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-12T20:51:28.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vitest",
"vendor": "vitest-dev",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.0.125"
},
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.6.1"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2.1.9"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.0.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.7,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1385",
"description": "CWE-1385: Missing Origin Validation in WebSockets",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-04T19:36:50.509Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq"
},
{
"name": "https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46"
},
{
"name": "https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76"
},
{
"name": "https://vitest.dev/config/#api",
"tags": [
"x_refsource_MISC"
],
"url": "https://vitest.dev/config/#api"
}
],
"source": {
"advisory": "GHSA-9crc-q9x8-hgqq",
"discovery": "UNKNOWN"
},
"title": "Remote Code Execution when accessing a malicious website while Vitest API server is listening"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-24964",
"datePublished": "2025-02-04T19:36:50.509Z",
"dateReserved": "2025-01-29T15:18:03.209Z",
"dateUpdated": "2025-02-12T20:51:28.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}