CVE-2025-24963

Vitest is a testing framework powered by Vite. The "screenshot-error" handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by "browser.api.host: true", an attacker can send a request to that handler from remote to ge...

CVE-2025-24963: Improper Limitation of a Pathname to a Restricted Directory

Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get th...