vitest has 5 CVEs on record. 3 were published in the last 90 days. The median CVSS is 6.5 (medium), with 2 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-22 (3). Most affected products: @vitest/browser (2), @vitest/mocker (2), @vitest/ui (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 3 prev 2
Products
- @vitest/browser 2
- @vitest/mocker 2
- @vitest/ui 1
Worst active — by depth score
CVE-2026-53633Critical· 9.8Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE54GHSA-p63j-vcc4-9vmvCritical· 9.4@vitest/browser: Browser Mode provider commands bypass the file-access permission gate52CVE-2026-112948Medium· 6.5Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file36CVE-2026-112950Medium· 5.9Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix33CVE-2026-84373Medium· 5.9Vitest is a testing framework powered by Vite33
vitest vulnerabilities
CVEs affecting vitest, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-112948Medium· 6.5Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
CVE-2026-112950Medium· 5.9Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
CVE-2026-84373Medium· 5.9Vitest is a testing framework powered by Vite
Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:regi…
GHSA-p63j-vcc4-9vmvCritical· 9.4@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
CVE-2026-53633Critical· 9.8Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE