p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de @vitest/mocker

Vulnérabilités publiées pour @vitest/mocker au cours des 30 derniers jours : 2. Présentes dans le catalogue KEV : 0.

RSS ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 3

  1. CVE-2026-112950

    Moyenne · CVSS 5.9EPSS 0,38%Code d’exploitation publicCorrectif disponible

    Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

    Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.

    @vitest/mocker @vitest/mockerNode.js
    • Mettez à jour vers 4.1.12
    • Mettez à jour vers 5.0.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-112949

    Moyenne · CVSS 4.7EPSS 0,24%Code d’exploitation publicCorrectif disponible

    Vitest: Code injection via unauthenticated manual mock registration

    Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.

    @vitest/mocker @vitest/mockerNode.js
    • Mettez à jour vers 4.1.12
    • Mettez à jour vers 5.0.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2026-84373

    Moyenne · CVSS 5.9EPSS 0,53%Correctif disponible

    Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

    Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl

    @vitest/mocker @vitest/mockerNode.js
    • Mettez à jour vers 4.1.11
    • Mettez à jour vers 5.0.0-rc.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →