Skip to content
OpenAdvisories

Product · @vitest

mocker

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-112950

    Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

    Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. W…

    vitest-dev @vitest vitest mocker Wolfi npm
  • Medium 4.7
    CVE-2026-112949

    Vitest: Code injection via unauthenticated manual mock registration

    Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock …

    vitest-dev @vitest vitest mocker Wolfi npm
  • Medium 5.9
    CVE-2026-84373

    Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

    Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's…

    vitest-dev @vitest vitest mocker Wolfi npm