Vitest Browser Mode - Local File Read

Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host- true, an attacker can send a request to that handler from remote to get th...

CVE-2025-24963

CVE-2025-24963 - Vitest Browser Mode - Local File Read ​CVE-2025-24963 is a medium-severity vulnerability CVSS 3.1 score: 5.9 affecting the @vitest/browser package, a component of the Vitest testing framework powered by Vite. This vulnerability arises from improper input validation in the...

CLSA-2026-1793115217 TuxCare security update for @vitest/mocker (1 CVE)

TuxCare rebuilt @vitest/mocker to address 1 CVE. Fixed in 4.0.18-tuxcare.5...

CLSA-2026-1793114894 TuxCare security update for @vitest/mocker (1 CVE)

TuxCare rebuilt @vitest/mocker to address 1 CVE. Fixed in 3.2.4-tuxcare.5...

CLSA-2026-1793093026 TuxCare security update for vitest (4 CVEs)

TuxCare rebuilt vitest to address 4 CVEs. Fixed in 2.0.5-tuxcare.1...

GHSA-JFWM-3P3C-6HX5 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outsid...

npm: Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

npm: Fallow: Jest and Vitest projects entries let an analyzed repository make Fallow read files outside the project root vulnerability discovered by ? in WordPress npm fallow versions = 2.68.0, 3.34.0...

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outsid...

CVE-2026-115569

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...

EUVD-2026-109119

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...

CVE-2026-115569 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...

CVE-2026-115569

The codebase intelligence tool Fallow is vulnerable to a path traversal and link following issue in versions 2.68.0 through 3.34.0 . Specifically, attacker-controlled Jest projects paths can force the tool to read files outside the project root using absolute paths, parent segments, dot-prefixed ...

CVE-2026-115569 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...

CVE-2026-115569

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...

PT-2026-122435

Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outsid...

PT-2026-122199

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...

SUSE CVE-2026-114126

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. ...

Cross-site Scripting (XSS)

Vitest is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of attacker-controlled URLs inserted into generated module source by createManualModuleSource, which allows an unauthenticated attacker to register a malicious mock through a WebSocket connection a...

Sensitive File Disclosure

Vitest is vulnerable to Sensitive File Disclosure. The vulnerability is due to misapplication of server.fs.deny on Vitest dev servers, where the server serves files such as .env, private keys, .git repositories, and the .vitest-secret-token over plain HTTP, and an attacker who can reach the UI,...

acinguiux-dnr-components (>=3.9.1, <=4.0.4), acinguiux-ds-react-framework (>=0.1.26, <=0.1.29) +1 more potentially affected by CVE-2026-114126 via @storybook/addon-vitest (>=10.2.0, <=10.5.9)

@storybook/addon-vitest NPM version =10.2.0, =3.9.1, =0.1.26, =0.0.8, =0.0.21 Source cves: CVE-2026-114126 Source advisory: OSV:GHSA-PX85-F4Q5-JH77...