CVE-2025-24963

Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get th...

CVE-2025-24963

CVE-2025-24963 concerns Vitest browser-mode HTTP server. The vulnerability arises from the __screenshot-error handler, which can respond with arbitrary files from the host filesystem when the browser-mode server is exposed to the network (e.g., via browser.api.host: true). Under these conditions,...

CVE-2025-24963 Browser mode serves arbitrary files in vitest

Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get th...

CVE-2025-24963 Browser mode serves arbitrary files in vitest

Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get th...

CVE-2025-24964 Remote Code Execution when accessing a malicious website while Vitest API server is listening

Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. When api option is enabled Vitest UI enables it, Vitest starts a...

CVE-2025-24964 Remote Code Execution when accessing a malicious website while Vitest API server is listening

Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. When api option is enabled Vitest UI enables it, Vitest starts a...

CVE-2025-24964

Vitest CVE-2025-24964 is a remotely exploitable CSWSH (Cross-site WebSocket hijacking) vulnerability in the Vitest API server when api is enabled. The WebSocket server did not validate Origin or enforce authorization, exposing saveTestFile (edits test files) and rerun (executes tests) APIs. An at...

CVE-2025-24964 Remote Code Execution when accessing a malicious website while Vitest API server is listening

Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. When api option is enabled Vitest UI enables it, Vitest starts a...

@accelint/vitest-config (=0.1.4), @ai16z/plugin-evm (>=0.1.5-alpha.2 <=0.1.5-alpha.5) +86 more potentially affected by CVE-2025-24964 via vitest (>=2.0.1 <=2.1.8)

vitest NPM version =2.0.1, =0.1.5-alpha.2, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.0.0, =0.0.1, =0.1.1, =1.2.1, =0.0.1, =0.1.8-alpha.1, =0.1.9 and more Source cves: CVE-2025-24964 Source advisory: OSV:GHSA-9CRC-Q9X8-HGQQ...

modern-web-swiss-army-knife (>=2.7.0 <=2.7.1), nuxt-ignis (>=0.1.7 <=0.1.9) +1 more potentially affected by CVE-2025-24964 via vitest (>=3.0.2 <=3.0.4)

vitest NPM version =3.0.2, =2.7.0, =0.1.7, =0.0.1, =0.0.2 Source cves: CVE-2025-24964 Source advisory: OSV:GHSA-9CRC-Q9X8-HGQQ...

@armit/eslint-config-bases (>=0.1.1 <=0.1.5), @bpinternal/expresso (=0.2.4) +43 more potentially affected by CVE-2025-24964 via vitest (>=1.0.1 <=1.6.0)

vitest NPM version =1.0.1, =0.1.1, =1.2.3, =1.7.0, =1.7.0, =1.7.0, =1.0.295, =8.22.0, =0.0.0, =1.4.0, =4.7.0, =1.0.0, =1.1.5 and more Source cves: CVE-2025-24964 Source advisory: OSV:GHSA-9CRC-Q9X8-HGQQ...

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

Summary Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. Details When api option is enabled Vitest UI enables it, Vitest starts a WebSocket server. This WebSocket server did not check Origin...

GHSA-9CRC-Q9X8-HGQQ Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

Summary Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. Details When api option is enabled Vitest UI enables it, Vitest starts a WebSocket server. This WebSocket server did not check Origin...

Vitest 路径遍历漏洞

Vitest is a Vite-powered next-generation testing framework open-sourced by Vitest. Vitest has a path traversal vulnerability that originates from a screenshot-error handler on a browser-mode HTTP server that responds to any file on the filesystem...

Vitest 安全漏洞

Vitest is a Vite-powered next-generation testing framework open-sourced by Vitest. A security vulnerability exists in Vitest that stems from vulnerability to arbitrary remote code execution attacks...

PT-2025-5608

Name of the Vulnerable Software and Affected Versions Vitest versions prior to 1.6.1 Vitest versions prior to 2.1.9 Vitest versions prior to 3.0.5 Description The issue is related to arbitrary remote code execution when accessing a malicious website while the Vitest API server is listening, due t...