Vitest-dev Vitest
5 CVEs affecting Vitest-dev Vitest. Latest disclosed: 2026-07-14. Critical: 4, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53633 | Critical | 9.8 | 2026-07-14 | Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chro… |
CVE-2026-47429 | Critical | 9.8 | 2026-07-14 | Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vites… |
CVE-2026-47428 | Critical | 9.6 | 2026-07-14 | Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier quer… |
CVE-2025-24964 | Critical | 9.6 | 2025-02-04 | Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest… |
CVE-2025-24963 | Medium | 5.9 | 2025-02-04 | Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Espe… |