Skip to content
OpenAdvisories

Package · npm

vitest

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.9
    CVE-2026-84373

    Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

    Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's…

    vitest-dev @vitest vitest mocker npm
  • Critical 9.8
    CVE-2026-47429 Public exploit

    Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

    Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API wri…

    vitest-dev vitest vitest npm
  • Critical 9.7
    CVE-2025-24964

    Remote Code Execution when accessing a malicious website while Vitest API server is listening

    Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is ena…

    vitest-dev vitest vitest npm