Vitest-dev - vulnerabilities (CVEs)
10 CVEs in 1 products, 3 in the last 30 days, newest from 2026-10-20.
Products
- Vitest - 10 CVEs
Newest CVEs of Vitest-dev
- CVE-2026-112950 - CVSS 5.9 (medium), 2026-10-20: Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem…
- CVE-2026-112949 - CVSS 4.7 (medium), 2026-10-20: Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser…
- CVE-2026-112948 - CVSS 6.5 (medium), 2026-10-20: Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace…
- CVE-2026-84373 - CVSS 5.9 (medium), 2026-09-01: Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in…
- CVE-2026-73653 - CVSS 9.4 (critical), 2026-08-13: Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload,…
- CVE-2026-53633 - CVSS 9.8 (critical), 2026-07-14: Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw…
- CVE-2026-47428 - CVSS 9.6 (critical), 2026-07-14: Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier…
- CVE-2026-47429 - CVSS 9.8 (critical), 2026-07-14: Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for…
- CVE-2025-24963 - CVSS 7.5 (high), 2025-02-04: Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system.…
- CVE-2025-24964 - CVSS 9.7 (critical), 2025-02-04: Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while…
