TI-2025-18644 Aliases CVE-2025-24964 GHSA-9crc-q9x8-hgqq

Remote Code Execution when accessing a malicious website while Vitest API server is listening

HIGH 76CWE-1385Published 2025-02-04 · Updated 2025-02-12

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00682 52nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed vitest (vitest-dev): 1.6.1, 2.1.9, 3.0.5vitest (npm): 1.6.1, 2.1.9, 3.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
vitest-dev	vitest	up to 0.0.125; 1.0.0 to before 1.6.1; 2.0.0 to before 2.1.9; 3.0.0 to before 3.0.5	1.6.1, 2.1.9, 3.0.5	Patch available	CNA
—	vitest (npm)	1.0.0 to before 1.6.1	1.6.1	Patch available	GHSA-9crc-q9x8-hgqq
—	vitest (npm)	2.0.0 to before 2.1.9	2.1.9	Patch available	GHSA-9crc-q9x8-hgqq
—	vitest (npm)	3.0.0 to before 3.0.5	3.0.5	Patch available	GHSA-9crc-q9x8-hgqq
—	vitest (npm)	up to 0.0.125	—	No fix listed	GHSA-9crc-q9x8-hgqq

vitest Vendorvitest-dev Affected up to 0.0.125; 1.0.0 to before 1.6.1; 2.0.0 to before 2.1.9; 3.0.0 to before 3.0.5 Fixed in 1.6.1, 2.1.9, 3.0.5 Patch available CNA
vitest (npm) Vendor— Affected 1.0.0 to before 1.6.1 Fixed in 1.6.1 Patch available GHSA-9crc-q9x8-hgqq
vitest (npm) Vendor— Affected 2.0.0 to before 2.1.9 Fixed in 2.1.9 Patch available GHSA-9crc-q9x8-hgqq
vitest (npm) Vendor— Affected 3.0.0 to before 3.0.5 Fixed in 3.0.5 Patch available GHSA-9crc-q9x8-hgqq
vitest (npm) Vendor— Affected up to 0.0.125 Fixed in — No fix listed GHSA-9crc-q9x8-hgqq

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vitest.dev:vitest::::::node.js::*	up to 0.0.125; 1.0.0 to before 1.6.1; 2.0.0 to before 2.1.9; 3.0.0 to before 3.0.5	Vulnerable	vitest-dev

cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:node.js:*:* Versions up to 0.0.125; 1.0.0 to before 1.6.1; 2.0.0 to before 2.1.9; 3.0.0 to before 3.0.5 Vulnerable ·vitest-dev

Remediation

Fix · CNA vitest (vitest-dev) Fixed in 1.6.1, 2.1.9, 3.0.5
Fix · GHSA-9crc-q9x8-hgqq vitest (npm) Fixed in 1.6.1 Advisory →
Fix · GHSA-9crc-q9x8-hgqq vitest (npm) Fixed in 2.1.9 Advisory →
Fix · GHSA-9crc-q9x8-hgqq vitest (npm) Fixed in 3.0.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-24964
2026-10-03 Alias added: GHSA-9crc-q9x8-hgqq

References

Exploit 1

https://github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-24964

Other 7

TI-2026-34992 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening CVSS 3.1CRITICAL 9.8
TI-2025-18643 Browser mode serves arbitrary files in vitest CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences