Vitest-dev vulnerabilities
We track 5 vulnerabilities in Vitest-dev products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on August 13, 2026.
Latest Vitest-dev vulnerabilities
- 9.4 Critical severity
vitest: Improper Limitation of a Pathname to a Restricted Directory
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file
- 9.8 Critical severity
vitest: Exposed Dangerous Method or Function
Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client
- 9.6 Critical severity
vitest: Improper Neutralization of Input During Web Page Generation
Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to
- 8.8 High severity
vitest: Missing Origin Validation in WebSockets
Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enab
- 7.5 High severity
vitest: Improper Limitation of a Pathname to a Restricted Directory
Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a re