Vitest-dev Vitest vulnerabilities

• @vitest mocker, vitest-dev vitest +1 more Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix CVE-2026-112950 Fix available 5.9 MediumOctober 20, 2026
• vitest-dev vitest, @vitest mocker +1 more Vitest: Code injection via unauthenticated manual mock registration CVE-2026-112949 Fix available 4.7 MediumOctober 20, 2026
• @vitest browser, ui, vitest-dev vitest +1 more +3 more Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file CVE-2026-112948 Fix available 6.5 MediumOctober 20, 2026
• @vitest mocker, vitest-dev vitest +1 more Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock CVE-2026-84373 Fix available 5.9 MediumSeptember 1, 2026
• vitest-dev vitest Vitest: Browser Mode provider commands bypass the file-access permission gate CVE-2026-73653 Fix available 9.4 CriticalJuly 21, 2026
• vitest-dev vitest Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE CVE-2026-53633 Fix available 9.8 CriticalJune 15, 2026
• vitest-dev vitest Vitest browser mode serves unsanitized otelCarrier query parameter as inline script CVE-2026-47428 Fix available 9.6 CriticalJune 1, 2026
• vitest-dev vitest Vitest: Arbitrary file can be read and executed when Vitest UI server is listening CVE-2026-47429 Public exploitFix available 9.8 CriticalJune 1, 2026
• vitest-dev vitest Remote Code Execution when accessing a malicious website while Vitest API server is listening CVE-2025-24964 Fix available 9.7 CriticalFebruary 4, 2025
• vitest-dev vitest Browser mode serves arbitrary files in vitest CVE-2025-24963 Public exploitFix available 5.9 MediumFebruary 4, 2025