Vulnerabilities

Filters

1 selected

10 records

Sort

Vendor: vitest-dev Clear all filters

TI-2026-76917 CVE-2026-112950 · GHSA-xp26-3454-mjgp

Backslash traversal in Vitest mocker exposes files on Windows

MEDIUM 60

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00542 Published 2026-10-20 Fixed in 4.1.12, 5.0.3 CWE-22

TI-2026-76916 CVE-2026-112949 · GHSA-qxg6-89mg-rqv8

Code injection in Vitest manual mock registration

MEDIUM 55

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00336 Published 2026-10-20 Partial fix · 4.1.12, 5.0.3 CWE-116

TI-2026-76915 CVE-2026-112948 · GHSA-p458-7748-mcp3

Vitest servers misapply server.fs.deny, exposing sensitive files

LOW 29

Vitest is a testing framework powered by Vite.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.004 Published 2026-10-20 Partial fix · 5.0.5, 1.3.0 CWE-200

TI-2026-57984 CVE-2026-84373 · GHSA-82fw-gwwq-j7x9

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

LOW 27

Vitest is a testing framework powered by Vite.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00527 Published 2026-09-01 Partial fix · 4.1.11, 5.0.0-rc.2 CWE-22

TI-2026-51737 CVE-2026-73653 · GHSA-p63j-vcc4-9vmv

Vitest: Browser Mode provider commands bypass the file-access permission gate

MEDIUM 50

Vitest is a testing framework powered by Vite.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.0079 Published 2026-08-13 Partial fix · 3.2.7, 4.1.10 +1 CWE-22

TI-2026-38677 CVE-2026-53633 · GHSA-g8mr-85jm-7xhm

Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

HIGH 82

Vitest is a testing framework powered by Vite.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00896 Published 2026-07-14 Fixed in 3.2.5, 4.1.8 +2 CWE-749

TI-2026-34991 CVE-2026-47428 · GHSA-2h32-95rg-cppp

Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

HIGH 76

Vitest is a testing framework powered by Vite.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.0058 Published 2026-07-14 Fixed in 4.1.6, 5.0.0-beta.3 CWE-79

TI-2026-34992 CVE-2026-47429 · GHSA-5xrq-8626-4rwp

Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

HIGH 82

Vitest is a testing framework powered by Vite.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01028 Published 2026-07-14 Fixed in 3.2.5, 4.1.0 +1 CWE-22

TI-2025-18643 CVE-2025-24963 · GHSA-8gvc-j273-4wm5

Browser mode serves arbitrary files in vitest

HIGH 68

Vitest is a testing framework powered by Vite.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02403 Published 2025-02-04 Fixed in 2.1.9, 3.0.4 CWE-22

TI-2025-18644 CVE-2025-24964 · GHSA-9crc-q9x8-hgqq

Remote Code Execution when accessing a malicious website while Vitest API server is listening

HIGH 76

Vitest is a testing framework powered by Vite.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00682 Published 2025-02-04 Fixed in 1.6.1, 2.1.9 +1 CWE-1385