499 matches found
Vitest Browser Mode - Local File Read
Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host- true, an attacker can send a request to that handler from remote to get th...
CVE-2025-24963
CVE-2025-24963 - Vitest Browser Mode - Local File Read CVE-2025-24963 is a medium-severity vulnerability CVSS 3.1 score: 5.9 affecting the @vitest/browser package, a component of the Vitest testing framework powered by Vite. This vulnerability arises from improper input validation in the...
CVE-2026-112950
A flaw was found in the Vitest mocker component when running on Windows systems. A remote attacker with access to the development server can exploit inconsistent path separator handling between file access validation and filesystem operations. By registering mock requests containing backslash...
CLEANSTART-2026-XQ99685 Vitest is a testing framework powered by Vite
Security vulnerability affects the qdrant package. Vitest is a testing framework powered by Vite...
CLEANSTART-2026-MT41724 Vitest is a testing framework powered by Vite
Security vulnerability affects the renovate package. Vitest is a testing framework powered by Vite...
CLEANSTART-2026-QF50909 Vitest is a testing framework powered by Vite
Security vulnerability affects the renovate package. Vitest is a testing framework powered by Vite...
CLSA-2026-1793115217 TuxCare security update for @vitest/mocker (1 CVE)
TuxCare rebuilt @vitest/mocker to address 1 CVE. Fixed in 4.0.18-tuxcare.5...
CLSA-2026-1793114894 TuxCare security update for @vitest/mocker (1 CVE)
TuxCare rebuilt @vitest/mocker to address 1 CVE. Fixed in 3.2.4-tuxcare.5...
CLSA-2026-1793093026 TuxCare security update for vitest (2 CVEs)
TuxCare rebuilt vitest to address 2 CVEs. Fixed in 2.0.5-tuxcare.1...
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outsid...
npm: Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
npm: Fallow: Jest and Vitest projects entries let an analyzed repository make Fallow read files outside the project root vulnerability discovered by ? in WordPress npm fallow versions = 2.68.0, 3.34.0...
GHSA-JFWM-3P3C-6HX5 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outsid...
CVE-2026-115569
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...
EUVD-2026-109119
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...
CVE-2026-115569 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...
CVE-2026-115569
The codebase intelligence tool Fallow is vulnerable to a path traversal and link following issue in versions 2.68.0 through 3.34.0 . Specifically, attacker-controlled Jest projects paths can force the tool to read files outside the project root using absolute paths, parent segments, dot-prefixed ...
CVE-2026-115569 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...
CVE-2026-115569
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...
Path Traversal
Vitest is vulnerable to Path Traversal. The vulnerability is due to inconsistent handling of backslashes between path validation and filesystem access on Windows, which allows an attacker who can access the Vite development server to craft a redirect mock that bypasses server.fs.allow restriction...
PT-2026-122435
Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outsid...