Go to packages list

vitest-mocker

Ecosystem: npm

Downloads: 568.24 Mln

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 0HighAffects 0 versions
  • 0MediumAffects 0 versions
  • 3ModerateAffects 6 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical0 (0.0%)
  • High0 (0.0%)
  • Medium0 (0.0%)
  • Moderate3 (100.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 2 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 2
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting vitest-mocker, based on data from OSV.

Vulnerabilities affecting vitest-mocker
IDSeveritySummaryAffected versionsPublishedSource
GHSA-qxg6-89mg-rqv8ModerateVitest: Code injection via unauthenticated manual mock registration### Summary `@vitest/mocker`'s `interceptorPlugin` accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's `url` into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin. Same handler and same unauthenticated caller as GHSA-82fw-gwwq-j7x9; that fix (`8ff9b9a9efca7c6cfd5243569440de8d7a33aec4`, PR #10972) hardened only the `redirect` branch and left the `manual` branch reachi
  • >= 2.1.0-beta.7, < 4.1.12
  • >= 5.0.0-beta.1, < 5.0.3
GitHub (opens in a new tab)
GHSA-xp26-3454-mjgpModerateVitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix## Summary The path traversal fix released for [GHSA-82fw-gwwq-j7x9](https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9) can be bypassed on Windows by using a backslash in the redirect URL pathname. The fixed code joins an attacker-controlled URL pathname with the Vite root using `node:path/posix`, then passes that string to Vite's file allowlist check. On Windows, a value such as `C:/project/root/..\secret.txt` retains `..\` during the POSIX join and begins with the allowed root, so the allowlist accepts it. The later `readFile()` call uses Windows filesystem seman
  • >= 4.1.11, < 4.1.12
  • >= 5.0.0-rc.2, < 5.0.3
GitHub (opens in a new tab)
GHSA-82fw-gwwq-j7x9ModerateVitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock## Summary `@vitest/mocker` registers a redirect mock's target path without validating it against the dev server's file-serving allowlist. An attacker who can reach the dev server's WebSocket can register a redirect mock pointing outside the project root; when the mocked module is requested, the plugin's `load` hook returns `readFile(<attacker path>)` as the module source, disclosing local files. This is exploitable **without authentication** only through the public `mockerPlugin` / standalone `interceptorPlugin` exports (used by third-party dev servers), which register the handler on Vite's
  • >= 2.1.0, < 4.1.11
  • >= 5.0.0-beta.1, < 5.0.0-rc.2
GitHub (opens in a new tab)
  • GHSA-qxg6-89mg-rqv8Moderate
    Vitest: Code injection via unauthenticated manual mock registration
    • >= 2.1.0-beta.7, < 4.1.12
    • >= 5.0.0-beta.1, < 5.0.3
    GitHub (opens in a new tab)

    ### Summary `@vitest/mocker`'s `interceptorPlugin` accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's `url` into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin. Same handler and same unauthenticated caller as GHSA-82fw-gwwq-j7x9; that fix (`8ff9b9a9efca7c6cfd5243569440de8d7a33aec4`, PR #10972) hardened only the `redirect` branch and left the `manual` branch reachi

    CVE: CVE-2026-112949

  • GHSA-xp26-3454-mjgpModerate
    Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
    • >= 4.1.11, < 4.1.12
    • >= 5.0.0-rc.2, < 5.0.3
    GitHub (opens in a new tab)

    ## Summary The path traversal fix released for [GHSA-82fw-gwwq-j7x9](https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9) can be bypassed on Windows by using a backslash in the redirect URL pathname. The fixed code joins an attacker-controlled URL pathname with the Vite root using `node:path/posix`, then passes that string to Vite's file allowlist check. On Windows, a value such as `C:/project/root/..\secret.txt` retains `..\` during the POSIX join and begins with the allowed root, so the allowlist accepts it. The later `readFile()` call uses Windows filesystem seman

    CVE: CVE-2026-112950

  • GHSA-82fw-gwwq-j7x9Moderate
    Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
    • >= 2.1.0, < 4.1.11
    • >= 5.0.0-beta.1, < 5.0.0-rc.2
    GitHub (opens in a new tab)

    ## Summary `@vitest/mocker` registers a redirect mock's target path without validating it against the dev server's file-serving allowlist. An attacker who can reach the dev server's WebSocket can register a redirect mock pointing outside the project root; when the mocked module is requested, the plugin's `load` hook returns `readFile(<attacker path>)` as the module source, disclosing local files. This is exploitable **without authentication** only through the public `mockerPlugin` / standalone `interceptorPlugin` exports (used by third-party dev servers), which register the handler on Vite's

    CVE: CVE-2026-84373

Showing 1-3 of 3 vulnerabilities