Skip to content
OpenAdvisories

Package · npm

@vitest/browser

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-112948

    Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

    Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An atta…

    vitejs vitest-dev @vitest vite-plus npm
  • Medium 5.9
    CVE-2025-24963 Public exploit Scanner template

    Browser mode serves arbitrary files in vitest

    Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a r…

    vitest-dev vitest @vitest/browser npm