Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Summary @vitest/mocker registers a redirect mock's target path without validating it against the dev server's file-serving allowlist. An attacker who can reach the dev server's WebSocket can register a redirect mock pointing outside the project root; when the mocked module is requested, the...

@0xshogun/sdk (>=1.0.3, <=1.1.6), @100xsystems/test-suite-typescript (>=0.1.0, <=0.1.2) +1673 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=2.1.0, <=4.1.10)

@vitest/mocker NPM version =2.1.0, =1.0.3, =0.1.0, =0.0.1, =0.2.4, =0.0.3, =0.2.0, =0.0.1, =0.1.1, =0.1.1, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =0.0.14, =0.0.16 and more Source cves: CVE-2026-84373 Source advisory: OSV:GHSA-82FW-GWWQ-J7X9...

@pixui-dev/inflight-report (>=0.0.7-inflight.3, <=0.1.0), @vitest/browser (>=5.0.0-beta.1, <=5.0.0-rc.1) +4 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=5.0.0-beta.1, <=5.0.0-rc.1)

@vitest/mocker NPM version =5.0.0-beta.1, =0.0.7-inflight.3, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-rc.1 Source cves: CVE-2026-84373 Source advisory: GHSA-82FW-GWWQ-J7X9...

@0xshogun/sdk (>=1.0.3, <=1.1.6), @100xsystems/test-suite-typescript (>=0.1.0, <=0.1.2) +1673 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=2.1.0, <=4.1.10)

@vitest/mocker NPM version =2.1.0, =1.0.3, =0.1.0, =0.0.1, =0.2.4, =0.0.3, =0.2.0, =0.0.1, =0.1.1, =0.1.1, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =0.0.14, =0.0.16 and more Source cves: CVE-2026-84373 Source advisory: GHSA-82FW-GWWQ-J7X9...

@pixui-dev/inflight-report (>=0.0.7-inflight.3, <=0.1.0), @vitest/browser (>=5.0.0-beta.1, <=5.0.0-rc.1) +4 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=5.0.0-beta.1, <=5.0.0-rc.1)

@vitest/mocker NPM version =5.0.0-beta.1, =0.0.7-inflight.3, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-rc.1 Source cves: CVE-2026-84373 Source advisory: OSV:GHSA-82FW-GWWQ-J7X9...

NPM: Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

NPM: Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock vulnerability discovered by ? in WordPress Npm vitest versions = 2.1.0, 4.1.11...

Malicious Package

Overview vitest-cli-dev is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-15870 Malicious code in vitest-cli-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffecbd11a726d511cf3bc41e65ce2a83329b247239d230aeeff9ad70b0e5953 [email protected] is a typosquat package: its name and homepage suggest a vitest tool, but the tarball contains a copy of nodemailer plus an...

Malicious code in vitest-cli-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffecbd11a726d511cf3bc41e65ce2a83329b247239d230aeeff9ad70b0e5953 [email protected] is a typosquat package: its name and homepage suggest a vitest tool, but the tarball contains a copy of nodemailer plus an...

SUSE CVE-2026-84373

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without...

Malicious Package

Overview vitest-cli-pro is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-15818 Malicious code in vitest-cli-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2 Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a...

Malicious code in vitest-cli-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2 Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a...

Linux Distros Unpatched Vulnerability : CVE-2026-84373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in...

Directory Traversal

Overview @vitest/mocker is a Vitest module mocker implementation Affected versions of this package are vulnerable to Directory Traversal through the interceptorPlugin redirect-mock handling in packages/mocker/src/node/interceptorPlugin.ts. An attacker can make the plugin register a redirect mock...

@pixui-dev/inflight-report (>=0.0.7-inflight.3, <=0.1.0), @vitest/browser (>=5.0.0-beta.1, <=5.0.0-rc.1) +4 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=5.0.0-beta.1, <=5.0.0-rc.1)

@vitest/mocker NPM version =5.0.0-beta.1, =0.0.7-inflight.3, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-rc.1 Source cves: CVE-2026-84373 Source advisory: SNYK:JS-VITESTMOCKER-19497933...

@0xshogun/sdk (>=1.0.3, <=1.1.6), @100xsystems/test-suite-typescript (>=0.1.0, <=0.1.2) +1673 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=2.1.0, <=4.1.10)

@vitest/mocker NPM version =2.1.0, =1.0.3, =0.1.0, =0.0.1, =0.2.4, =0.0.3, =0.2.0, =0.0.1, =0.1.1, =0.1.1, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =0.0.14, =0.0.16 and more Source cves: CVE-2026-84373 Source advisory: SNYK:JS-VITESTMOCKER-19497933...

CVE-2026-84373

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without...

CVE-2026-84373

A flaw was found in Vitest, a testing framework. A remote attacker, able to reach an exposed development server, could exploit an issue in the mockerPlugin and interceptorPlugin exports. These plugins register a handler on Vite's unauthenticated HMR WebSocket without properly validating redirect...

@0xshogun/sdk (>=1.0.3, <=1.1.6), @100xsystems/test-suite-typescript (>=0.1.0, <=0.1.2) +1491 more potentially affected by CVE-2026-84373 via vitest (>=2.1.0, <=4.1.10)

vitest NPM version =2.1.0, =1.0.3, =0.1.0, =0.0.1, =0.2.4, =0.0.3, =0.2.0, =0.1.1, =0.1.1, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =0.0.14, =0.6.0, =1.0.1 and more Source cves: CVE-2026-84373 Source advisory: MEND:CVE-2026-84373...