VI
Product
vitest
10
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 3High 2Medium 5Low 0
Watch
Add vitest to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-53633 | 9.8 | Jul 14 | Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE Affected: >= 3.0.0, < 3.2.5; >= 4.0.0, < 4.1.8; >= 5.0.0-beta.0, < 5.0.0-beta.4 |
| CVE-2026-47428 | 9.6 | Jul 14 | Vitest browser mode serves unsanitized otelCarrier query parameter as inline script Affected: >= 4.0.17, < 4.1.6; >= 5.0.0-beta.0, < 5.0.0-beta.3 |
| CVE-2026-73653 | 9.4 | Aug 13 | Vitest: Browser Mode provider commands bypass the file-access permission gate Affected: < 3.2.7; >= 4.0.0, < 4.1.10; >= 5.0.0-beta.1, < 5.0.0-beta.6 |
| CVE-2025-24964 | 8.8 | Feb 4 | Vitest is a testing framework powered by Vite Affected: through 0.0.125; 1.0.0 before 1.6.1; 2.0.0 before 2.1.9; 3.0.0 before 3.0.5 |
| CVE-2025-24963 | 7.5 | Feb 4 | Vitest is a testing framework powered by Vite Affected: before 2.1.9; 3.0.0 before 3.0.4 |
| CVE-2026-112948 | 6.5 | Oct 20 | Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file Affected: >= 5.0.0-beta.6, < 5.0.5 |
| CVE-2026-112950 | 5.9 | Oct 20 | Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix Affected: >= 4.1.11, < 4.1.12; >= 5.0.0-rc.2, < 5.0.3 |
| CVE-2026-84373 | 5.9 | Sep 1 | Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock Affected: >= 2.1.0, < 4.1.11; >= 5.0.0-beta.1, < 5.0.0-rc.2 |
| CVE-2026-47429 | 5.9 | Jul 14 | Vitest: Arbitrary file can be read and executed when Vitest UI server is listening Affected: < 3.2.5; >= 4.0.0, < 4.1.0 |
| CVE-2026-112949 | 4.7 | Oct 20 | Vitest: Code injection via unauthenticated manual mock registration Affected: >= 2.1.0-beta.7, < 4.1.12; >= 5.0.0, < 5.0.3 |
Showing 10