CVE-2025-24963

CVE-2025-24963 - Vitest 브라우저 모드 - 로컬 파일 읽기 ​CVE-2025-24963은 @vitest/browser 패키지에 영향을 미치는 중간 심각도 취약점CVSS 3.1 점수: 5.9입니다. 이 패키지는 Vite 기반의 Vitest 테스트 프레임워크의 구성 요소입니다. 이 취약점은 브라우저 모드 HTTP 서버의 screenshot-error 핸들러에서 입력 검증이 부적절하여 발생합니다. 서버가 구성 옵션 browser.api.host: true를 사용하여 네트워크에 노출되면 공격자가 특수하게 조작된 요청...

VulnCheck KEV: CVE-2025-24963

Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get th...

Vitest 路径遍历漏洞

Vitest is a Vite-powered next-generation testing framework open-sourced by Vitest. Vitest has a path traversal vulnerability that originates from a screenshot-error handler on a browser-mode HTTP server that responds to any file on the filesystem...

PT-2025-5607

Name of the Vulnerable Software and Affected Versions: Vitest versions prior to 2.1.9 Vitest versions prior to 3.0.4 Description: The screenshot-error handler on the browser mode HTTP server responds to any file on the file system. If the server is exposed on the network by browser.api.host: true...

CVE-2021-0477

In notifyScreenshotError of ScreenshotNotificationsController.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersion...