Go to packages list

vitest

Ecosystem: npm

Downloads: 577.12 Mln

Vulnerabilities from the last (months)
  • 2CriticalAffects 6 versions
  • 0HighAffects 0 versions
  • 0MediumAffects 0 versions
  • 1ModerateAffects 2 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical2 (66.7%)
  • High0 (0.0%)
  • Medium0 (0.0%)
  • Moderate1 (33.3%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 1
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 1
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting vitest, based on data from OSV.

Vulnerabilities affecting vitest
IDSeveritySummaryAffected versionsPublishedSource
GHSA-82fw-gwwq-j7x9ModerateVitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock## Summary `@vitest/mocker` registers a redirect mock's target path without validating it against the dev server's file-serving allowlist. An attacker who can reach the dev server's WebSocket can register a redirect mock pointing outside the project root; when the mocked module is requested, the plugin's `load` hook returns `readFile(<attacker path>)` as the module source, disclosing local files. This is exploitable **without authentication** only through the public `mockerPlugin` / standalone `interceptorPlugin` exports (used by third-party dev servers), which register the handler on Vite's
  • >= 2.1.0, < 4.1.11
  • >= 5.0.0-beta.1, < 5.0.0-rc.2
GitHub (opens in a new tab)
GHSA-5xrq-8626-4rwpCriticalWhen Vitest UI server is listening, arbitrary file can be read and executed### Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network. ### Impact Only users that match either of the following conditions are affected: - explicitly exposes the Vitest UI server to the network (using `--api.host` or [`api.host` config option](https://vitest.dev/config/api.html)) - running the Vitest UI or Browser Mode on Windows ### Details The API handler for `/__vitest_attachment__` uses the deprecated `isFileServingAllowed` incorrectly. https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3b
  • >= 4.0.0, < 4.1.0
  • < 3.2.6
GitHub (opens in a new tab)
GHSA-9crc-q9x8-hgqqCriticalVitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening### Summary Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. ### Details When [`api` option](https://vitest.dev/config/#api) is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46 This WebSocket server has `saveTestFile` A
  • >= 1.0.0, < 1.6.1
  • >= 2.0.0, < 2.1.9
  • >= 3.0.0, < 3.0.5
  • <= 0.0.125
GitHub (opens in a new tab)
  • GHSA-82fw-gwwq-j7x9Moderate
    Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
    • >= 2.1.0, < 4.1.11
    • >= 5.0.0-beta.1, < 5.0.0-rc.2
    GitHub (opens in a new tab)

    ## Summary `@vitest/mocker` registers a redirect mock's target path without validating it against the dev server's file-serving allowlist. An attacker who can reach the dev server's WebSocket can register a redirect mock pointing outside the project root; when the mocked module is requested, the plugin's `load` hook returns `readFile(<attacker path>)` as the module source, disclosing local files. This is exploitable **without authentication** only through the public `mockerPlugin` / standalone `interceptorPlugin` exports (used by third-party dev servers), which register the handler on Vite's

    CVE: CVE-2026-84373

  • GHSA-5xrq-8626-4rwpCritical
    When Vitest UI server is listening, arbitrary file can be read and executed
    • >= 4.0.0, < 4.1.0
    • < 3.2.6
    GitHub (opens in a new tab)

    ### Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network. ### Impact Only users that match either of the following conditions are affected: - explicitly exposes the Vitest UI server to the network (using `--api.host` or [`api.host` config option](https://vitest.dev/config/api.html)) - running the Vitest UI or Browser Mode on Windows ### Details The API handler for `/__vitest_attachment__` uses the deprecated `isFileServingAllowed` incorrectly. https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3b

    CVE: CVE-2026-47429

  • GHSA-9crc-q9x8-hgqqCritical
    Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
    • >= 1.0.0, < 1.6.1
    • >= 2.0.0, < 2.1.9
    • +2 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 1.0.0, < 1.6.1
    • >= 2.0.0, < 2.1.9
    • >= 3.0.0, < 3.0.5
    • <= 0.0.125

    ### Summary Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. ### Details When [`api` option](https://vitest.dev/config/#api) is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46 This WebSocket server has `saveTestFile` A

    CVE: CVE-2025-24964

Showing 1-3 of 3 vulnerabilities