Browser mode serves arbitrary files in vitest
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vitest-dev | vitest | 2.0.4 to before 2.1.9; 3.0.0 to before 3.0.4 | 2.1.9, 3.0.4 | Patch available | CNA |
| — | @vitest/browser (npm) | 2.0.4 to before 2.1.9 | 2.1.9 | Patch available | GHSA-8gvc-j273-4wm5 |
| — | @vitest/browser (npm) | 3.0.0 to before 3.0.4 | 3.0.4 | Patch available | GHSA-8gvc-j273-4wm5 |
- vitest Vendorvitest-dev Affected 2.0.4 to before 2.1.9; 3.0.0 to before 3.0.4 Fixed in 2.1.9, 3.0.4 Patch available CNA
- @vitest/browser (npm) Vendor— Affected 2.0.4 to before 2.1.9 Fixed in 2.1.9 Patch available GHSA-8gvc-j273-4wm5
- @vitest/browser (npm) Vendor— Affected 3.0.0 to before 3.0.4 Fixed in 3.0.4 Patch available GHSA-8gvc-j273-4wm5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:node.js:*:* | before 2.1.9; 3.0.0 to before 3.0.4 | Vulnerable | vitest-dev |
- cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:node.js:*:* Versions before 2.1.9; 3.0.0 to before 3.0.4 Vulnerable ·vitest-dev
Remediation
- Fix · CNA vitest (vitest-dev) Fixed in 2.1.9, 3.0.4
- Fix · GHSA-8gvc-j273-4wm5 @vitest/browser (npm) Fixed in 2.1.9 Advisory →
- Fix · GHSA-8gvc-j273-4wm5 @vitest/browser (npm) Fixed in 3.0.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-24963
- 2026-10-03 Alias added: GHSA-8gvc-j273-4wm5
References
Advisory 2
Other 4
- https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130
- https://vitest.dev/guide/browser/config.html#browser-api
- https://github.com/vitest-dev/vitest/commit/ed9aeba212df04b83ed01810780663ff2cdd0adf
- https://github.com/vitest-dev/vitest
More vitest-dev Vitest vulnerabilities
- TI-2026-34992 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening CVSS 3.1CRITICAL 9.8
- TI-2025-18644 Remote Code Execution when accessing a malicious website while Vitest API server is listening CVSS 3.1CRITICAL 9.7
Sources
- CVE-2025-24963 · CVE Program
- CVE-2025-24963 · NVD
- FIRST EPSS
- GHSA-8gvc-j273-4wm5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences