Vulnerabilities in vitest-dev
10 resultsCVE-2025-24963MEDIUMBrowser mode serves arbitrary files in vitestEPSS 2.4%CVE-2026-47429CRITICALVitest: Arbitrary file can be read and executed when Vitest UI server is listeningEPSS 1.0%CVE-2026-53633CRITICALVitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCEEPSS 0.9%CVE-2026-73653CRITICALVitest: Browser Mode provider commands bypass the file-access permission gateEPSS 0.8%CVE-2025-24964CRITICALRemote Code Execution when accessing a malicious website while Vitest API server is listeningEPSS 0.7%CVE-2026-47428CRITICALVitest browser mode serves unsanitized otelCarrier query parameter as inline scriptEPSS 0.6%CVE-2026-112950MEDIUMVitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fixEPSS 0.5%CVE-2026-84373MEDIUMVitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect MockEPSS 0.5%CVE-2026-112948MEDIUMVitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token fileEPSS 0.4%CVE-2026-112949MEDIUMVitest: Code injection via unauthenticated manual mock registrationEPSS 0.3%