VI
Vendor
vitest-dev
10
CVEs
0
On KEV
3
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112950 | VI vitest vitest-dev | 5.9 | Oct 20 | Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix |
| CVE-2026-112949 | VI vitest vitest-dev | 4.7 | Oct 20 | Vitest: Code injection via unauthenticated manual mock registration |
| CVE-2026-112948 | VI vitest vitest-dev | 6.5 | Oct 20 | Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file |
| CVE-2026-84373 | VI vitest vitest-dev | 5.9 | Sep 1 | Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock |
| CVE-2026-73653 | VI vitest vitest-dev | 9.4 | Aug 13 | Vitest: Browser Mode provider commands bypass the file-access permission gate |
| CVE-2026-53633 | VI vitest vitest-dev | 9.8 | Jul 14 | Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE |
| CVE-2026-47428 | VI vitest vitest-dev | 9.6 | Jul 14 | Vitest browser mode serves unsanitized otelCarrier query parameter as inline script |
| CVE-2026-47429 | VI vitest vitest-dev | 5.9 | Jul 14 | Vitest: Arbitrary file can be read and executed when Vitest UI server is listening |
| CVE-2025-24964 | VI Vitest Vitest.dev | 8.8 | Feb 4 | Vitest is a testing framework powered by Vite |
| CVE-2025-24963 | VI Vitest Vitest.dev | 7.5 | Feb 4 | Vitest is a testing framework powered by Vite |