vitest vulnerabilities
CVEs whose affected-version data names the vitest package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-112949Medium· 4.7PoCVitest: Code injection via unauthenticated manual mock registration
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can r…
▾ Twilightvitest-dev · vitestEPSS 0.34%via CVEORG
CVE-2026-84373Medium· 5.9Vitest is a testing framework powered by Vite
Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:regi…
▾ Sunlitvitest · @vitest/mockerEPSS 0.53%via NVD