236 matches found
CVE-2026-112948
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...
CVE-2026-112949
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...
CVE-2026-112950
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev...
CVE-2026-112950
The Vitest testing framework (versions 4.1.11 to 4.1.12 and 5.0.3) is vulnerable to a path traversal flaw on Windows systems. The root cause is an inconsistency in how isFileLoadingAllowed and filesystem read operations interpret backslashes within packages/mocker/src/node/interceptorPlugin.ts. A...
EUVD-2026-105152
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev...
CVE-2026-112949 Vitest: Code injection via unauthenticated manual mock registration
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...
CVE-2026-112949
The Vitest testing framework for JavaScript and TypeScript projects is vulnerable to code injection in versions 2.1.0-beta.7 through 4.1.12 and 5.0.3 . An unauthenticated non-browser WebSocket client capable of reaching a development server via interceptorPlugin can register a manual mock. Becaus...
CVE-2026-112948 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...
CVE-2026-112948
The Vitest testing framework (versions 5.0.0-beta.6 through 5.0.5 ) contains a vulnerability where dev servers misapply server.fs.deny. The root cause is that project servers replace Vite's defaults, and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker reachi...
EUVD-2026-105143
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...
Vitest Browser Mode - Local File Read
Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host- true, an attacker can send a request to that handler from remote to get th...
CVE-2025-24963
CVE-2025-24963 - Vitest Browser Mode - Local File Read CVE-2025-24963 is a medium-severity vulnerability CVSS 3.1 score: 5.9 affecting the @vitest/browser package, a component of the Vitest testing framework powered by Vite. This vulnerability arises from improper input validation in the...
CLEANSTART-2026-MR36651 Vitest is a testing framework powered by Vite
Security vulnerability affects the qdrant package. Vitest is a testing framework powered by Vite...
CLEANSTART-2026-BX79488 Vitest is a testing framework powered by Vite
Security vulnerability affects the qdrant package. Vitest is a testing framework powered by Vite...
NPM: Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
NPM: Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock vulnerability discovered by ? in WordPress Npm vitest versions = 2.1.0, 4.1.11...
@0xshogun/sdk (>=1.0.3, <=1.1.6), @100xsystems/test-suite-typescript (>=0.1.0, <=0.1.2) +1491 more potentially affected by CVE-2026-84373 via vitest (>=2.1.0, <=4.1.10)
vitest NPM version =2.1.0, =1.0.3, =0.1.0, =0.0.1, =0.2.4, =0.0.3, =0.2.0, =0.1.1, =0.1.1, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =0.0.14, =0.6.0, =1.0.1 and more Source cves: CVE-2026-84373 Source advisory: OSV:GHSA-82FW-GWWQ-J7X9...
@0xshogun/sdk (>=1.0.3, <=1.1.6), @100xsystems/test-suite-typescript (>=0.1.0, <=0.1.2) +1491 more potentially affected by CVE-2026-84373 via vitest (>=2.1.0, <=4.1.10)
vitest NPM version =2.1.0, =1.0.3, =0.1.0, =0.0.1, =0.2.4, =0.0.3, =0.2.0, =0.1.1, =0.1.1, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =0.0.14, =0.6.0, =1.0.1 and more Source cves: CVE-2026-84373 Source advisory: GHSA-82FW-GWWQ-J7X9...
@pixui-dev/inflight-report (>=0.0.7-inflight.3, <=0.1.0) potentially affected by CVE-2026-84373 via vitest (5.0.0-beta.5)
vitest NPM version 5.0.0-beta.5 is affected by a known vulnerability. The following packages have a transitive dependency on vitest and may be impacted: - @pixui-dev/inflight-report =0.0.7-inflight.3, =0.1.0 Source cves: CVE-2026-84373 Source advisory: OSV:GHSA-82FW-GWWQ-J7X9...
@pixui-dev/inflight-report (>=0.0.7-inflight.3, <=0.1.0) potentially affected by CVE-2026-84373 via vitest (5.0.0-beta.5)
vitest NPM version 5.0.0-beta.5 is affected by a known vulnerability. The following packages have a transitive dependency on vitest and may be impacted: - @pixui-dev/inflight-report =0.0.7-inflight.3, =0.1.0 Source cves: CVE-2026-84373 Source advisory: GHSA-82FW-GWWQ-J7X9...