Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-47428 is a vulnerability in Vitest's Browser Mode that permits arbitrary JavaScript execution through a crafted URL, potentially exposing sensitive tokens and enabling unauthorized API calls. Red Hat's assessment confirms that none of their products ship or enable the vulnerable @vitest/browser package or Browser Mode, and affected streams already include patched versions (>=4.1.6) or versions outside the vulnerable range. The Red Hat Hardened Images RPMs update includes prometheus3.13-3.13.1-0.1.hum1 for aarch64 and x86_64 architectures, addressing bugs and enhancements unrelated to this vulnerability. No known exploits are reported in the wild.

If exploited in an environment using the vulnerable Vitest Browser Mode, an attacker could execute arbitrary JavaScript code on the Vitest server, potentially leading to disclosure of the VITEST_API_TOKEN and unauthorized authenticated API calls. However, Red Hat products are not affected as they do not include or enable the vulnerable component. Thus, there is no impact on Red Hat shipping products.

No mitigation is required for Red Hat shipping products since the vulnerable @vitest/browser package and Browser Mode are not present or enabled. Development teams using Vitest should avoid enabling Browser Mode or introducing @vitest/browser in CI or local environments and should upgrade to Vitest version 4.1.6 or later (or 5.0.0-beta.3 on the beta line) where Vitest is used.