What’s Vulnerable › Products

vitest-dev vitest vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your vitest-dev vitest version is affected

Latest vitest-dev vitest vulnerabilities

• CVE-2026-112950 — Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix (CVSS 5.9)
• CVE-2026-112949 — Vitest: Code injection via unauthenticated manual mock registration (CVSS 4.7)
• CVE-2026-112948 — Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file (CVSS 6.5)
• CVE-2026-84373 — Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock (CVSS 5.9)
• CVE-2026-73653 — Vitest: Browser Mode provider commands bypass the file-access permission gate (CVSS 9.4)
• CVE-2026-53633 — Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE (CVSS 9.8)
• CVE-2026-47429 — Vitest: Arbitrary file can be read and executed when Vitest UI server is listening (CVSS 5.9)
• CVE-2026-47428 — Vitest browser mode serves unsanitized otelCarrier query parameter as inline script (CVSS 9.6)
• CVE-2025-24964 — Remote Code Execution when accessing a malicious website while Vitest API server is listening (CVSS 8.8)
• CVE-2025-24963 — Browser mode serves arbitrary files in vitest (CVSS 7.5)