Skip to content
OpenAdvisories

Vendor

vitest-dev

10 known vulnerabilities.

Products

vitest 10
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-47429 Public exploit

    Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

    Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API wri…

    vitest-dev vitest vitest npm
  • Medium 5.9
    CVE-2025-24963 Public exploit

    Browser mode serves arbitrary files in vitest

    Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a r…

    vitest-dev vitest @vitest/browser npm