A path traversal vulnerability (CWE-22) exists in vitest versions 4.1.11 up to but not including 4.1.12, and 5.0.0-rc.2 up to but not including 5.0.3. On Windows systems, this flaw allows a client who can reach the Vite dev server to craft a redirect mock with backslash traversal sequences that bypass filesystem restrictions, enabling reading of files outside the intended allowed directory. The issue is fixed in versions 4.1.12 and 5.0.3.
Vitest, a Vite-native testing framework for JavaScript and TypeScript, contains a code injection vulnerability in versions from 2.1.0-beta.7 up to but not including 4.1.12 and from 5.0.0 up to but not including 5.0.3. An unauthenticated non-browser WebSocket client can exploit this by registering a manual mock with an attacker-controlled URL that is inserted unescaped into generated module source. This leads to execution of attacker-controlled JavaScript on the development server origin when the developer's browser loads the module. The issue is fixed in versions 4.1.12 and 5.0.3.
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.
Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWrite permission gate or confining paths to the project root. A client that can reach the Browser Mode API can read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process even when allowWrite is false. This issue is fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6.
Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.
Vitest versions from 4.0.17 up to but not including 4.1.6, and version 5.0.0-beta.3, contain a cross-site scripting (XSS) vulnerability in Browser Mode. The vulnerability arises because the otelCarrier query parameter is directly inserted into an inline module script without proper neutralization. This allows crafted URLs to execute arbitrary JavaScript in the Vitest server origin and potentially recover sensitive API tokens. The issue is fixed starting from version 4.1.6 and later.
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.