Vulnerabilities

TI-2026-76917 CVE-2026-112950 · GHSA-xp26-3454-mjgp

Backslash traversal in Vitest mocker exposes files on Windows

MEDIUM 60

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00542 Published 2026-10-20 Fixed in 4.1.12, 5.0.3 CWE-22

TI-2026-76916 CVE-2026-112949 · GHSA-qxg6-89mg-rqv8

MEDIUM 55

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00336 Published 2026-10-20 Partial fix · 4.1.12, 5.0.3 CWE-116

TI-2026-76915 CVE-2026-112948 · GHSA-p458-7748-mcp3

LOW 29

Vitest is a testing framework powered by Vite.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.004 Published 2026-10-20 Partial fix · 5.0.5, 1.3.0 CWE-200

TI-2026-57984 CVE-2026-84373 · GHSA-82fw-gwwq-j7x9

LOW 27

Vitest is a testing framework powered by Vite.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00527 Published 2026-09-01 Partial fix · 4.1.11, 5.0.0-rc.2 CWE-22