CVE-2026-47428 is a vulnerability in Vitest's Browser Mode that permits remote code execution through a specially crafted browser-runner URL. This flaw can also expose the VITEST_API_TOKEN, enabling unauthorized authenticated API calls. Red Hat has confirmed that none of its shipping products install or enable the vulnerable @vitest/browser package or Browser Mode; Vitest is used only as a build/test-time devDependency without Browser Mode. Several affected Vitest streams have been patched in versions 4.1.6 and above. Consequently, Red Hat products are not reachable via this vulnerability. The advisory also references CVE-2026-47429 and includes fixes in Red Hat Hardened Images RPMs for prometheus3.13 packages, but no direct fixes for this CVE are needed in Red Hat products.

If exploited in an environment where Vitest Browser Mode is enabled, this vulnerability allows remote attackers to execute arbitrary JavaScript code on the Vitest server and potentially access sensitive tokens, leading to unauthorized API calls and system compromise. However, Red Hat products do not include or enable the vulnerable component, so there is no impact on Red Hat shipping products. The vulnerability is critical in general but does not affect Red Hat's delivered software.

No mitigation is required for Red Hat shipping products because the vulnerable @vitest/browser package and Browser Mode are not present or enabled. Development teams using Vitest as a build/test-time dependency should avoid introducing @vitest/browser or enabling Browser Mode in CI or local environments. They should upgrade to Vitest version 4.1.6 or later (or 5.0.0-beta.3 on the beta line) to ensure patched versions are used.