Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
Priority HIGH 76CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0058 47th percentileScored 2026-11-07
Fix Fixed vitest (vitest-dev): 4.1.6, 5.0.0-beta.3@vitest/browser (npm): 4.1.6, 5.0.0-beta.3Red Hat: 1 advisory
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vitest-dev | vitest | 4.0.17 to before 4.1.6; 5.0.0-beta.0 to before 5.0.0-beta.3 | 4.1.6, 5.0.0-beta.3 | Patch available | CNA |
| — | @vitest/browser (npm) | 4.0.17 to before 4.1.6 | 4.1.6 | Patch available | GHSA-2h32-95rg-cppp |
| — | @vitest/browser (npm) | 5.0.0-beta.0 to before 5.0.0-beta.3 | 5.0.0-beta.3 | Patch available | GHSA-2h32-95rg-cppp |
- vitest Vendorvitest-dev Affected 4.0.17 to before 4.1.6; 5.0.0-beta.0 to before 5.0.0-beta.3 Fixed in 4.1.6, 5.0.0-beta.3 Patch available CNA
- @vitest/browser (npm) Vendor— Affected 4.0.17 to before 4.1.6 Fixed in 4.1.6 Patch available GHSA-2h32-95rg-cppp
- @vitest/browser (npm) Vendor— Affected 5.0.0-beta.0 to before 5.0.0-beta.3 Fixed in 5.0.0-beta.3 Patch available GHSA-2h32-95rg-cppp
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:*:*:* | — | — | vitest-dev |
- cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:*:*:* Versions — — ·vitest-dev
Remediation
- Fix · CNA vitest (vitest-dev) Fixed in 4.1.6, 5.0.0-beta.3
- Fix · GHSA-2h32-95rg-cppp @vitest/browser (npm) Fixed in 4.1.6 Advisory →
- Fix · GHSA-2h32-95rg-cppp @vitest/browser (npm) Fixed in 5.0.0-beta.3 Advisory →
Red Hat 1 advisory
- RHSA-2026:39058 Released 2026-07-13 · Red Hat rating CriticalRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images prometheus3.13-3.13.1-0.1.hum1@aarch64, prometheus3.13-3.13.1-0.1.hum1@src, prometheus3.13-3.13.1-0.1.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Hardened Images | Fixed | RHSA-2026:39058 |
Not affected: 7 products
- Red Hat AMQ Broker 7
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Keycloak
- Red Hat Build of Podman Desktop
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-47428
- 2026-10-03 Alias added: GHSA-2h32-95rg-cppp
- 2026-11-05 Affected versions changed · Red Hat
References
Other 10
- https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp
- https://github.com/vitest-dev/vitest/pull/10283
- https://github.com/vitest-dev/vitest/pull/10285
- https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06
- https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa
- https://github.com/vitest-dev/vitest/releases/tag/v4.1.6
- https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3
- https://github.com/vitest-dev/vitest
- https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/client/public/esm-client-injector.js#L41
- https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/node/serverOrchestrator.ts#L48
More vitest-dev vulnerabilities
- TI-2026-38677 Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE CVSS 3.1CRITICAL 9.8
- TI-2026-34992 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening CVSS 3.1CRITICAL 9.8
- TI-2025-18644 Remote Code Execution when accessing a malicious website while Vitest API server is listening CVSS 3.1CRITICAL 9.7
- TI-2025-18643 Browser mode serves arbitrary files in vitest CVSS 3.1HIGH 7.5
- TI-2026-76917 Backslash traversal in Vitest mocker exposes files on Windows CVSS 3.1MEDIUM 5.9
- TI-2026-76916 Code injection in Vitest manual mock registration CVSS 3.1MEDIUM 4.7
Sources
- CVE-2026-47428 · CVE Program
- CVE-2026-47428 · NVD
- FIRST EPSS
- GHSA-2h32-95rg-cppp · GitHub Advisory Database · CC BY 4.0
- CVE-2026-47428 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences