Login Request a demo
VI
Product
vitest
by vitest-dev · last CVE Oct 20, 2026
10
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 3High 2Medium 5Low 0
Severity
All severities10Critical3High2Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add vitest to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-53633
9.8
1%
Jul 14
Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Affected: >= 3.0.0, < 3.2.5; >= 4.0.0, < 4.1.8; >= 5.0.0-beta.0, < 5.0.0-beta.4
CVE-2026-47428
9.6
1%
Jul 14
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
Affected: >= 4.0.17, < 4.1.6; >= 5.0.0-beta.0, < 5.0.0-beta.3
CVE-2026-73653
9.4
1%
Aug 13
Vitest: Browser Mode provider commands bypass the file-access permission gate
Affected: < 3.2.7; >= 4.0.0, < 4.1.10; >= 5.0.0-beta.1, < 5.0.0-beta.6
Showing 3