vitest-dev vitest vulnerabilities
10 published CVEs name vitest-dev vitest among the affected products.
- 10Published CVEs10 of them scored
- 8Last 12 monthspublished in the last year
- 5Critical0 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-112950
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
vitest-dev · vitest
Medium5.9 - CVE-2026-112949
Vitest: Code injection via unauthenticated manual mock registration
vitest-dev · vitest
Medium4.7 - CVE-2026-112948
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
vitest-dev · vitest
Medium6.5 - CVE-2026-84373
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
vitest-dev · vitest
Medium5.9 - CVE-2026-73653
Vitest: Browser Mode provider commands bypass the file-access permission gate
vitest-dev · vitest
Critical9.4 - CVE-2026-53633
Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
vitest-dev · vitest
Critical9.8 - CVE-2026-47428
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
vitest-dev · vitest
Critical9.6 - CVE-2026-47429
Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
vitest-dev · vitest
Critical9.8 - CVE-2025-24963
Browser mode serves arbitrary files in vitest
vitest-dev · vitest
Medium5.9 - CVE-2025-24964
Remote Code Execution when accessing a malicious website while Vitest API server is listening
vitest-dev · vitest
Critical9.7