VI
Product
vitest
10
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 3High 2Medium 5Low 0
Watch
Add vitest to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-112948 | 6.5 | Oct 20 | Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file Affected: >= 5.0.0-beta.6, < 5.0.5 |
| CVE-2026-112950 | 5.9 | Oct 20 | Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix Affected: >= 4.1.11, < 4.1.12; >= 5.0.0-rc.2, < 5.0.3 |
| CVE-2026-84373 | 5.9 | Sep 1 | Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock Affected: >= 2.1.0, < 4.1.11; >= 5.0.0-beta.1, < 5.0.0-rc.2 |
| CVE-2026-47429 | 5.9 | Jul 14 | Vitest: Arbitrary file can be read and executed when Vitest UI server is listening Affected: < 3.2.5; >= 4.0.0, < 4.1.0 |
| CVE-2026-112949 | 4.7 | Oct 20 | Vitest: Code injection via unauthenticated manual mock registration Affected: >= 2.1.0-beta.7, < 4.1.12; >= 5.0.0, < 5.0.3 |
Showing 5