Attack Chain

1. The attacker crafts a malicious URL targeting the /__vitest_test__/ endpoint, embedding JavaScript code within the otelCarrier query parameter.
2. The victim opens the attacker-crafted URL in a web browser while the Vitest browser server is running.
3. The Vitest server reflects the unsanitized otelCarrier parameter directly into an inline module script within the generated HTML page.
4. The injected JavaScript executes within the victim’s browser, in the Vitest server origin.
5. The attacker’s script accesses window.VITEST_API_TOKEN, compromising the Vitest WebSocket API token.
6. The attacker uses the compromised API token to authenticate with the Vitest WebSocket API endpoint at /__vitest_browser_api__.
7. The attacker calls the triggerCommand function via the WebSocket to write a malicious payload into the vite.config.ts file.
8. Vitest/Vite reloads the modified configuration file, resulting in the execution of the injected code within the Node.js environment, achieving remote code execution (RCE).

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript code within the Vitest server’s origin. In a default local browser-mode setup, this XSS can be leveraged to compromise the Vitest API token, leading to server-side code execution. A confirmed proof of concept demonstrates modifying vite.config.ts to execute arbitrary code in Node. This issue poses a significant risk to developers and CI/CD environments using Vitest in browser mode.

Recommendation

• Apply the patch or upgrade to a non-vulnerable version of @vitest/browser to address CVE-2026-47428.
• Deploy the Sigma rule “Detect Vitest otelCarrier Parameter Injection” to identify potential exploitation attempts by detecting suspicious characters in the otelCarrier query parameter within web server logs.
• Block access to the known malicious URLs (e.g., http://localhost:63315/__vitest_test__/?otelCarrier=(alert(%22xss%20via%20otelCarrier%22)%2Cnull)) listed in the IOC section at the network perimeter.