CVE-2025-24964

Vitest CVE-2025-24964 is a remotely exploitable CSWSH (Cross-site WebSocket hijacking) vulnerability in the Vitest API server when api is enabled. The WebSocket server did not validate Origin or enforce authorization, exposing saveTestFile (edits test files) and rerun (executes tests) APIs. An at...

CVE-2025-24963

Vitest Browser Mode Local File Read (CVE-2025-24963): The __screenshot-error HTTP handler in Vitest’s browser mode can serve arbitrary files if the server is exposed to the network (browser.api.host: true). Root cause tied to commit 2d62051. Impact is reading arbitrary filesystem content; remedia...