@vitest vulnerabilities

Products

• browser 5
• mocker 3
• ui 1

Latest @vitest CVEs

Newest publication first

1. CVE-2026-112950 Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

   Published 2026-10-20

   Medium·CVSS 5.9 EPSS 0.54%

   Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reac...

2. CVE-2026-112949 Vitest: Code injection via unauthenticated manual mock registration

   Published 2026-10-20

   Medium·CVSS 4.7 EPSS 0.34%

   Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-contro...

3. CVE-2026-112948 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

   Published 2026-10-20

   Medium·CVSS 6.5 EPSS 0.40%

   Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an...

4. CVE-2026-84373 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

   Published 2026-09-01

   Medium·CVSS 5.9 EPSS 0.53%

   Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR...

5. CVE-2026-73653 Vitest: Browser Mode provider commands bypass the file-access permission gate

   Published 2026-08-13

   Critical·CVSS 9.4 EPSS 0.79%

   Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enfor...

6. CVE-2026-53633 Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

   Published 2026-07-14

   Critical·CVSS 9.8 EPSS 0.90%

   Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browse...

7. CVE-2026-47428 Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

   Published 2026-07-14

   Critical·CVSS 9.6 EPSS 0.58%

   Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /vitest_test/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaSc...

8. CVE-2025-24963 Browser mode serves arbitrary files in vitest

   Published 2025-02-04

   High·CVSS 7.5 EPSS 2.4%

   Vitest is a testing framework powered by Vite. The __screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler fr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.