@baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.278 <=2.1.0-alpha.281), @baic/preset-yolk-umi-mobile (>=2.1.0-alpha.278 <=2.1.0-alpha.281) +8 more potentially affected by CVE-2026-47429 via @vitest/browser (>=4.0.0-beta.11 <=4.1.0-beta.2)

@vitest/browser NPM version =4.0.0-beta.11, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =4.0.0, =4.0.0, =4.0.0, =0.5.0, =0.1.0, =0.2.0-alpha.4 Source cves: CVE-2026-47429 Source advisory: SNYK:JS-VITESTBROWSER-17120327...

@1771technologies/oneplay (>=0.0.1 <=0.0.6), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.249 <=2.1.0-alpha.251) +7 more potentially affected by CVE-2026-47429 via @vitest/browser (>=3.0.5 <=3.2.4)

@vitest/browser NPM version =3.0.5, =0.0.1, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =3.8.0, =1.0.1, =0.0.2, =0.0.5 Source cves: CVE-2026-47429 Source advisory: SNYK:JS-VITESTBROWSER-17120327...

Missing Authorization

Overview @vitest/browser is a Browser running for Vitest Affected versions of this package are vulnerable to Missing Authorization through the api and browser.api request handlers in the server and UI components. An attacker can run tests, modify project files, or overwrite snapshots by connectin...

Missing Authorization

Overview @vitest/ui is an UI for Vitest Affected versions of this package are vulnerable to Missing Authorization through the api and browser.api request handlers in the server and UI components. An attacker can run tests, modify project files, or overwrite snapshots by connecting to an exposed...

@astralis-os/vitest (=2.4.1), @aws/nx-plugin (>=0.79.1 <=0.84.2) +64 more potentially affected by CVE-2026-47429 via vitest (>=4.0.13 <=4.0.9)

vitest NPM version =4.0.13, =0.79.1, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =4.0.0-alpha.31, =1.2.3-preview-a960555.0, =7.2.0, =11.0.33, =11.0.49 - @forsakringskassan/vitest-config =1.1.0 - @frovahappy/brush =0.2.0 and more Source cves:...

@0xkamal7/sui-agent (>=1.1.2 <=1.1.5), @1771technologies/oneplay (>=0.0.1 <=0.0.6) +2034 more potentially affected by CVE-2026-47429 via vitest (>=0.0.141 <=3.2.4)

vitest NPM version =0.0.141, =1.1.2, =0.0.1, =0.2.4, =1.0.0, =0.0.1, =1.0.7, =0.1.0, =4.9.1, =1.0.2, =0.0.14, =0.1.0, =1.1.0, =1.0.30, =0.2.2, =0.3.3 and more Source cves: CVE-2026-47429 Source advisory: OSV:GHSA-5XRQ-8626-4RWP...

@0xshogun/sdk (>=1.1.44 <=1.1.52), @0xshogun/sdk-react (>=1.1.14 <=1.1.65-beta) +7 more potentially affected by CVE-2026-47429 via @vitest/ui (>=3.0.7 <=3.2.4)

@vitest/ui NPM version =3.0.7, =1.1.44, =1.1.14, =0.5.0, =1.0.388, =1.1.52, =1.1.65, =1.0.0, =0.9.9, =0.10.4 Source cves: CVE-2026-47429 Source advisory: SNYK:JS-VITESTUI-17120328...

Missing Authorization

Overview vitest is a Next generation testing framework powered by Vite Affected versions of this package are vulnerable to Missing Authorization through the api and browser.api request handlers in the server and UI components. An attacker can run tests, modify project files, or overwrite snapshot...

GHSA-5XRQ-8626-4RWP When Vitest UI server is listening, arbitrary file can be read and executed

Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network. Impact Only users that match either of the following conditions are affected: - explicitly exposes the Vitest UI server to the network using --api.host or api.host config opti...

CVE-2026-53633

creationtimestamp| type| source ---|---|--- 2026-06-01 13:35:28+00:00| published-proof-of-concept| https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm 2026-07-15 20:46:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqplostaaq2v...

PT-2026-45491

Name of the Vulnerable Software and Affected Versions Vitest versions 4.0.17 through 4.1.5 Vitest versions 5.0.0-beta.0 through 5.0.0-beta.2 Description In browser mode, the software serves the '/ vitest test /' endpoint where the otelCarrier query parameter is inserted directly into an inline...

PT-2026-45492

Name of the Vulnerable Software and Affected Versions Vitest versions prior to 4.1.0 Description A flaw in the UI/API server on Windows allows remote attackers to bypass file access restrictions and read arbitrary files when the server is exposed to the network. The issue occurs because the API...

CVE-2026-47429

creationtimestamp| type| source ---|---|--- 2026-05-19 09:24:23+00:00| published-proof-of-concept| https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp 2026-06-07 23:20:25+00:00| seen| https://bsky.app/profile/securitylab-jp.bsky.social/post/3mnqcloetts2r 2026-06-09...

CVE-2026-47428

creationtimestamp| type| source ---|---|--- 2026-05-19 09:23:47+00:00| published-proof-of-concept| https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp 2026-07-15 13:38:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqotrh5lhp2u...

@c0va23/react-router-dev (=7.8.3-alpha.2), @holocron.so/cli (>=0.6.0 <=0.16.0) +15 more potentially affected by CVE-2026-23870 via @vitejs/plugin-rsc (>=0.4.11 <=0.5.24)

@vitejs/plugin-rsc NPM version =0.4.11, =0.6.0, =0.5.0, =0.0.1, =0.0.0-1ae0b37, =0.0.0-experimental-2a6c7bc, =0.0.0-pr-32412-sha-4e0feb24, =1.0.2, =0.1.0, =0.0.1, =1.18.0-rsc.19, =0.1.0, =0.0.1-alpha.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-23870 Source advisory:...

VulnCheck KEV: CVE-2025-24963

Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get th...

Malicious code in buildkite-test-collector-vitest-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 912ffea9e65720bd5b35e83949fe2f51e7ae71ac918133a5dd2c6d971b5947f4 The package buildkite-test-collector-vitest-example was found to contain malicious code...

MAL-2026-2736 Malicious code in buildkite-test-collector-vitest-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 912ffea9e65720bd5b35e83949fe2f51e7ae71ac918133a5dd2c6d971b5947f4 The package buildkite-test-collector-vitest-example was found to contain malicious code...

Malicious Package

Overview vitest-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1487 Malicious code in vitest-config (npm)

Malicious package due to preinstall script execution, system info gathering, Discord webhook usage for data exfiltration, and error suppression. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d6cfc9315582e56556f40906f86a19927ad32b3826548896d1eaf23e0705243 The...