@accelint/vitest-config (0.1.4), @ai16z/plugin-evm (>=0.1.5-alpha.2, <=0.1.5-alpha.5) +83 more potentially affected by CVE-2025-24964 via vitest (>=2.0.1, <=2.1.8)

vitest NPM version =2.0.1, =0.1.5-alpha.2, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.0.0, =0.0.1, =0.1.1, =1.2.1-preview-1bd7791.0, =0.0.1, =0.1.0 - @diia-inhouse/configs 3.1.5 - @elizaos/plugin-allora 0.1.8-alpha.1 - @elizaos/plugin-aptos 0.1.8-alpha.1 and more Source cves: CVE-2025-249...

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

Summary Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. Details When api option is enabled Vitest UI enables it, Vitest starts a WebSocket server. This WebSocket server did not check Origin...

@armit/eslint-config-bases (>=0.1.1, <=0.1.5), @bpinternal/expresso (0.2.4) +44 more potentially affected by CVE-2025-24964 via vitest (>=1.0.1, <=1.6.0)

vitest NPM version =1.0.1, =0.1.1, =1.2.3, =1.7.0, =1.7.0, =1.7.0, =1.0.295, =8.22.0, =0.0.0, =1.4.0, =4.7.0, =1.0.0, =1.1.5 and more Source cves: CVE-2025-24964 Source advisory: OSV:GHSA-9CRC-Q9X8-HGQQ...

@accelint/vitest-config (0.1.4), @ai16z/plugin-evm (>=0.1.5-alpha.2, <=0.1.5-alpha.5) +83 more potentially affected by CVE-2025-24964 via vitest (>=2.0.1, <=2.1.8)

vitest NPM version =2.0.1, =0.1.5-alpha.2, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.0.0, =0.0.1, =0.1.1, =1.2.1-preview-1bd7791.0, =0.0.1, =0.1.0 - @diia-inhouse/configs 3.1.5 - @elizaos/plugin-allora 0.1.8-alpha.1 - @elizaos/plugin-aptos 0.1.8-alpha.1 and more Source cves: CVE-2025-249...

modern-web-swiss-army-knife (>=2.7.0, <=2.7.1), nuxt-ignis (>=0.1.7, <=0.1.9) +1 more potentially affected by CVE-2025-24964 via vitest (>=3.0.2, <=3.0.4)

vitest NPM version =3.0.2, =2.7.0, =0.1.7, =0.0.1, =0.0.2 Source cves: CVE-2025-24964 Source advisory: GHSA-9CRC-Q9X8-HGQQ...

@accelint/vitest-config (0.1.4), @ai16z/plugin-evm (>=0.1.5-alpha.2, <=0.1.5-alpha.5) +83 more potentially affected by CVE-2025-24964 via vitest (>=2.0.1, <=2.1.8)

vitest NPM version =2.0.1, =0.1.5-alpha.2, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.0.0, =0.0.1, =0.1.1, =1.2.1-preview-1bd7791.0, =0.0.1, =0.1.0 - @diia-inhouse/configs 3.1.5 - @elizaos/plugin-allora 0.1.8-alpha.1 - @elizaos/plugin-aptos 0.1.8-alpha.1 and more Source cves: CVE-2025-249...

@armit/eslint-config-bases (>=0.1.1, <=0.1.5), @bpinternal/expresso (0.2.4) +44 more potentially affected by CVE-2025-24964 via vitest (>=1.0.1, <=1.6.0)

vitest NPM version =1.0.1, =0.1.1, =1.2.3, =1.7.0, =1.7.0, =1.7.0, =1.0.295, =8.22.0, =0.0.0, =1.4.0, =4.7.0, =1.0.0, =1.1.5 and more Source cves: CVE-2025-24964 Source advisory: GHSA-9CRC-Q9X8-HGQQ...

modern-web-swiss-army-knife (>=2.7.0, <=2.7.1), nuxt-ignis (>=0.1.7, <=0.1.9) +1 more potentially affected by CVE-2025-24964 via vitest (>=3.0.2, <=3.0.4)

vitest NPM version =3.0.2, =2.7.0, =0.1.7, =0.0.1, =0.0.2 Source cves: CVE-2025-24964 Source advisory: OSV:GHSA-9CRC-Q9X8-HGQQ...

GHSA-9CRC-Q9X8-HGQQ Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

Summary Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. Details When api option is enabled Vitest UI enables it, Vitest starts a WebSocket server. This WebSocket server did not check Origin...

Vitest path traversal vulnerability

Vitest is a Vite-powered next-generation testing framework open-sourced by Vitest. Vitest has a path traversal vulnerability that originates from a screenshot-error handler on a browser-mode HTTP server that responds to any file on the filesystem...

Vitest security vulnerabilities

Vitest is a Vite-powered next-generation testing framework open-sourced by Vitest. A security vulnerability exists in Vitest that stems from vulnerability to arbitrary remote code execution attacks...

CVE-2025-24963: Improper Limitation of a Pathname to a Restricted Directory

Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get th...

CVE-2025-24964: Missing Origin Validation in WebSockets

Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. When api option is enabled Vitest UI enables it, Vitest starts a...

PT-2025-5608

Name of the Vulnerable Software and Affected Versions Vitest versions prior to 1.6.1 Vitest versions prior to 2.1.9 Vitest versions prior to 3.0.5 Description The issue is related to arbitrary remote code execution when accessing a malicious website while the Vitest API server is listening, due t...