CVE-2026-112949: CWE-94: Improper Control of Generation of Code ('Code Injection') in vitest-dev vitest

Vitest, a Vite-native testing framework for JavaScript and TypeScript, suffers from a CWE-94 code injection vulnerability in versions >=2.1.0-beta.7 <4.1.12 and >=5.0.0 <5.0.3. An unauthenticated non-browser WebSocket client able to reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled URL is inserted unescaped into the generated module source. When the developer's browser loads this module, the attacker-controlled JavaScript executes with the development-server origin privileges. This vulnerability allows partial code injection leading to confidentiality and integrity impacts. The vulnerability has a CVSS 3.1 score of 4.7 (medium severity) and is fixed in versions 4.1.12 and 5.0.3.

The vulnerability allows an unauthenticated attacker with network access to the development server to inject and execute arbitrary JavaScript code in the developer's browser context on the development-server origin. This can lead to partial confidentiality and integrity loss of the development environment. There is no indication of availability impact. No known exploits are reported in the wild.

Upgrade Vitest to version 4.1.12 or later, or 5.0.3 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory.