@vitest mocker vulnerabilities

Latest @vitest mocker CVEs

Newest publication first

1. CVE-2026-112950 Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

   Published 2026-10-20

   Medium·CVSS 5.9 EPSS 0.54%

   Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reac...

2. CVE-2026-112949 Vitest: Code injection via unauthenticated manual mock registration

   Published 2026-10-20

   Medium·CVSS 4.7 EPSS 0.34%

   Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-contro...

3. CVE-2026-84373 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

   Published 2026-09-01

   Medium·CVSS 5.9 EPSS 0.53%

   Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.