CVE-2025-24964 Remote Code Execution when accessing a malicious website while Vitest API server is listening

Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. When api option is enabled Vitest UI enables it, Vitest starts a...

@armit/eslint-config-bases (>=0.1.1, <=0.1.5), @bpinternal/expresso (0.2.4) +44 more potentially affected by CVE-2025-24964 via vitest (>=1.0.1, <=1.6.0)

vitest NPM version =1.0.1, =0.1.1, =1.2.3, =1.7.0, =1.7.0, =1.7.0, =1.0.295, =8.22.0, =0.0.0, =1.4.0, =4.7.0, =1.0.0, =1.1.5 and more Source cves: CVE-2025-24964 Source advisory: MEND:CVE-2025-24964...

CVE-2025-24964

Vitest CVE-2025-24964 is a remotely exploitable CSWSH (Cross-site WebSocket hijacking) vulnerability in the Vitest API server when api is enabled. The WebSocket server did not validate Origin or enforce authorization, exposing saveTestFile (edits test files) and rerun (executes tests) APIs. An at...

modern-web-swiss-army-knife (>=2.7.0, <=2.7.1), nuxt-ignis (>=0.1.7, <=0.1.9) +1 more potentially affected by CVE-2025-24964 via vitest (>=3.0.2, <=3.0.4)

vitest NPM version =3.0.2, =2.7.0, =0.1.7, =0.0.1, =0.0.2 Source cves: CVE-2025-24964 Source advisory: MEND:CVE-2025-24964...

CVE-2025-24964 Remote Code Execution when accessing a malicious website while Vitest API server is listening

Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. When api option is enabled Vitest UI enables it, Vitest starts a...

@accelint/vitest-config (0.1.4), @ai16z/plugin-evm (>=0.1.5-alpha.2, <=0.1.5-alpha.5) +83 more potentially affected by CVE-2025-24964 via vitest (>=2.0.1, <=2.1.8)

vitest NPM version =2.0.1, =0.1.5-alpha.2, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.0.0, =0.0.1, =0.1.1, =1.2.1-preview-1bd7791.0, =0.0.1, =0.1.0 - @diia-inhouse/configs 3.1.5 - @elizaos/plugin-allora 0.1.8-alpha.1 - @elizaos/plugin-aptos 0.1.8-alpha.1 and more Source cves: CVE-2025-249...

CVE-2025-24964

Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. When "api" option is enabled Vitest UI enables it, Vitest starts...

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

Summary Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. Details When api option is enabled Vitest UI enables it, Vitest starts a WebSocket server. This WebSocket server did not check Origin...

@armit/eslint-config-bases (>=0.1.1, <=0.1.5), @bpinternal/expresso (0.2.4) +44 more potentially affected by CVE-2025-24964 via vitest (>=1.0.1, <=1.6.0)

vitest NPM version =1.0.1, =0.1.1, =1.2.3, =1.7.0, =1.7.0, =1.7.0, =1.0.295, =8.22.0, =0.0.0, =1.4.0, =4.7.0, =1.0.0, =1.1.5 and more Source cves: CVE-2025-24964 Source advisory: OSV:GHSA-9CRC-Q9X8-HGQQ...

@accelint/vitest-config (0.1.4), @ai16z/plugin-evm (>=0.1.5-alpha.2, <=0.1.5-alpha.5) +83 more potentially affected by CVE-2025-24964 via vitest (>=2.0.1, <=2.1.8)

vitest NPM version =2.0.1, =0.1.5-alpha.2, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.0.0, =0.0.1, =0.1.1, =1.2.1-preview-1bd7791.0, =0.0.1, =0.1.0 - @diia-inhouse/configs 3.1.5 - @elizaos/plugin-allora 0.1.8-alpha.1 - @elizaos/plugin-aptos 0.1.8-alpha.1 and more Source cves: CVE-2025-249...

modern-web-swiss-army-knife (>=2.7.0, <=2.7.1), nuxt-ignis (>=0.1.7, <=0.1.9) +1 more potentially affected by CVE-2025-24964 via vitest (>=3.0.2, <=3.0.4)

vitest NPM version =3.0.2, =2.7.0, =0.1.7, =0.0.1, =0.0.2 Source cves: CVE-2025-24964 Source advisory: GHSA-9CRC-Q9X8-HGQQ...

@accelint/vitest-config (0.1.4), @ai16z/plugin-evm (>=0.1.5-alpha.2, <=0.1.5-alpha.5) +83 more potentially affected by CVE-2025-24964 via vitest (>=2.0.1, <=2.1.8)

vitest NPM version =2.0.1, =0.1.5-alpha.2, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.0.0, =0.0.1, =0.1.1, =1.2.1-preview-1bd7791.0, =0.0.1, =0.1.0 - @diia-inhouse/configs 3.1.5 - @elizaos/plugin-allora 0.1.8-alpha.1 - @elizaos/plugin-aptos 0.1.8-alpha.1 and more Source cves: CVE-2025-249...

@armit/eslint-config-bases (>=0.1.1, <=0.1.5), @bpinternal/expresso (0.2.4) +44 more potentially affected by CVE-2025-24964 via vitest (>=1.0.1, <=1.6.0)

vitest NPM version =1.0.1, =0.1.1, =1.2.3, =1.7.0, =1.7.0, =1.7.0, =1.0.295, =8.22.0, =0.0.0, =1.4.0, =4.7.0, =1.0.0, =1.1.5 and more Source cves: CVE-2025-24964 Source advisory: GHSA-9CRC-Q9X8-HGQQ...

modern-web-swiss-army-knife (>=2.7.0, <=2.7.1), nuxt-ignis (>=0.1.7, <=0.1.9) +1 more potentially affected by CVE-2025-24964 via vitest (>=3.0.2, <=3.0.4)

vitest NPM version =3.0.2, =2.7.0, =0.1.7, =0.0.1, =0.0.2 Source cves: CVE-2025-24964 Source advisory: OSV:GHSA-9CRC-Q9X8-HGQQ...

GHSA-9CRC-Q9X8-HGQQ Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

Summary Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. Details When api option is enabled Vitest UI enables it, Vitest starts a WebSocket server. This WebSocket server did not check Origin...

CVE-2025-24964: Missing Origin Validation in WebSockets

Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. When api option is enabled Vitest UI enables it, Vitest starts a...

Vitest path traversal vulnerability

Vitest is a Vite-powered next-generation testing framework open-sourced by Vitest. Vitest has a path traversal vulnerability that originates from a screenshot-error handler on a browser-mode HTTP server that responds to any file on the filesystem...

Vitest security vulnerabilities

Vitest is a Vite-powered next-generation testing framework open-sourced by Vitest. A security vulnerability exists in Vitest that stems from vulnerability to arbitrary remote code execution attacks...

CVE-2025-24963: Improper Limitation of a Pathname to a Restricted Directory

Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get th...

PT-2025-5608

Name of the Vulnerable Software and Affected Versions Vitest versions prior to 1.6.1 Vitest versions prior to 2.1.9 Vitest versions prior to 3.0.5 Description The issue is related to arbitrary remote code execution when accessing a malicious website while the Vitest API server is listening, due t...