CRITICAL🇵🇱 Wersja polska

CVE-2025-24964

CVSS 9.6v3.1pub. 2025-02-04upd. 2025-12-31

Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

🤖 AI Analysis
How it works

When the `api` option is enabled (e.g., through Vitest UI), Vitest runs a WebSocket server that did not verify the Origin header or possess any authorization mechanism. An attacker can hijack the WebSocket connection from a malicious site and invoke the `saveTestFile` API to inject arbitrary code into a test file. Subsequently, calling the `rerun` API causes the modified file to run, resulting in execution of the injected code on the victim's machine.

Impact

An attacker can gain full control over the victim's system through remote code execution (RCE) — potentially leading to data disclosure, file modification, or further compromise of the development environment.

Mitigation & patch

Update Vitest to version 1.6.1, 2.1.9, or 3.0.5 (depending on the branch in use). The vendor does not indicate any known workarounds for this vulnerability — updating is the only effective protection method.

Who is affected

Vitest.Dev Vitest — versions before 1.6.1, before 2.1.9, and before 3.0.5, with the `api` option enabled (enabled by default through Vitest UI)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

  • Vitest.dev Vitest

    APP
    Vitest.Dev
    ≤ 0.0.1251.0.0 – 1.6.1 (excl.)2.0.0 – 2.1.9 (excl.)3.0.0 – 3.0.5 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2026-47429CRITICAL9.8PL ✓same product

Vitest (Windows): path traversal w UI/API server umożliwia odczyt plików i RCE

CVE-2025-24963MEDIUM5.9same product

Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP serve...