Product by Vitest-dev
Vitest
10 known vulnerabilities in Vitest (Vitest-dev), 0 of them actively exploited (CISA KEV).
Key figures
10
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-53633 | Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE | 9.8 | |
| Critical | CVE-2026-73653 | Vitest: Browser Mode provider commands bypass the file-access permission gate | 9.4 | |
| High | CVE-2025-24963 | Browser mode serves arbitrary files in vitest | 5.9 | |
| Critical | CVE-2026-47428 | Vitest browser mode serves unsanitized otelCarrier query parameter as inline script | 9.6 | |
| Critical | CVE-2025-24964 | Remote Code Execution when accessing a malicious website while Vitest API server is listening | 9.7 | |
| Critical | CVE-2026-47429 | Vitest: Arbitrary file can be read and executed when Vitest UI server is listening | 5.9 | |
| Medium | CVE-2026-112950 | Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix | 5.9 | |
| Medium | CVE-2026-112948 | Vitest: Files or Directories Accessible to External Parties | 6.5 | |
| Medium | CVE-2026-84373 | Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock | 5.9 | |
| Medium | CVE-2026-112949 | Vitest: Code injection via unauthenticated manual mock registration | 4.7 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 32sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28sans-atrisk-mail,