p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de vitest

Vulnerabilidades publicadas para vitest en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 3

  1. CVE-2026-84373

    Media · CVSS 5.9EPSS 0,53%Corrección disponible

    Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

    Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl

    vitest vitestNode.js
    • Actualiza a 4.1.11
    • Actualiza a 5.0.0-rc.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-47429

    Crítica · CVSS 9.8EPSS 0,88%Corrección disponible

    Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

    Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

    vitest vitestNode.js
    • Actualiza a 3.2.6
    • Actualiza a 4.1.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2025-24964

    Crítica · CVSS 9.7EPSS 0,68%Corrección disponible

    Remote Code Execution when accessing a malicious website while Vitest API server is listening

    Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `s

    vitest vitest vitest vitestNode.js
    • Actualiza a 1.6.1
    • Actualiza a 2.1.9
    • Actualiza a 3.0.5
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →