vitest-dev has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 5.9 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.9
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-112948Medium· 6.5Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file36CVE-2026-112950Medium· 5.9Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix32CVE-2026-112949Medium· 4.7Vitest: Code injection via unauthenticated manual mock registration26
vitest-dev vulnerabilities
CVEs affecting vitest-dev, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-112948Medium· 6.5Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compile…
CVE-2026-112949Medium· 4.7Vitest: Code injection via unauthenticated manual mock registration
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can r…
CVE-2026-112950Medium· 5.9Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/i…