[ Vendor · 3 CVEs ]
@vitest
CVEs affecting @vitest published in the last 30 days, plus any @vitest CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-112948 | 20 Oct 2026 | CVSS 6.5 | Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token fileVitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers… | Fix |
| CVE-2026-112949 | 20 Oct 2026 | CVSS 4.7 | Vitest: Code injection via unauthenticated manual mock registrationVitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated… | Fix |
| CVE-2026-112950 | 20 Oct 2026 | CVSS 5.9 | Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fixVitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the… | Fix |