p PatchFirst

PatchFirst · Latest vulnerabilities

vitest vulnerabilities

Vulnerabilities published for vitest in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3

  1. CVE-2026-84373

    Medium · CVSS 5.9EPSS 0.53%Fix available

    Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

    Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl

    vitest vitestNode.js
    • Update to 4.1.11
    • Update to 5.0.0-rc.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-47429

    Critical · CVSS 9.8EPSS 0.88%Fix available

    Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

    Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

    vitest vitestNode.js
    • Update to 3.2.6
    • Update to 4.1.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2025-24964

    Critical · CVSS 9.7EPSS 0.68%Fix available

    Remote Code Execution when accessing a malicious website while Vitest API server is listening

    Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `s

    vitest vitest vitest vitestNode.js
    • Update to 1.6.1
    • Update to 2.1.9
    • Update to 3.0.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →