@vitest vulnerabilities

Products

• Mocker 3

Newest

• @vitest mocker, vitest-dev vitest +1 more Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix CVE-2026-112950 Fix available 5.9 MediumOctober 20, 2026
• vitest-dev vitest, @vitest mocker +1 more Vitest: Code injection via unauthenticated manual mock registration CVE-2026-112949 Fix available 4.7 MediumOctober 20, 2026
• @vitest browser, ui, vitest-dev vitest +1 more +3 more Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file CVE-2026-112948 Fix available 6.5 MediumOctober 20, 2026
• @vitest mocker, vitest-dev vitest +1 more Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock CVE-2026-84373 Fix available 5.9 MediumSeptember 1, 2026