{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/vitest/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["vitest (\u003c 4.1.0)"],"_cs_severities":["critical"],"_cs_tags":["arbitrary-file-read","code-execution","vitest","cve-2026-47429"],"_cs_type":"threat","_cs_vendors":["Vitest"],"content_html":"\u003cp\u003eA critical vulnerability exists in Vitest versions prior to 4.1.0 that allows arbitrary file reads on Windows systems when the Vitest UI server is active, particularly if exposed to the network. The flaw stems from the incorrect usage of the deprecated \u003ccode\u003eisFileServingAllowed\u003c/code\u003e function within the \u003ccode\u003e/__vitest_attachment__\u003c/code\u003e API handler. By using the \u003ccode\u003e\\\\?\\\\..\\\\\u003c/code\u003e path traversal technique, attackers can bypass intended security checks and access files outside the project directory. This vulnerability, identified as CVE-2026-47429, could also lead to arbitrary script execution due to the API\u0026rsquo;s rerun and file write capabilities. To mitigate this, Vitest now includes \u003ccode\u003eallowWrite\u003c/code\u003e and \u003ccode\u003eallowExec\u003c/code\u003e configuration flags, which are disabled by default when the API server is bound to a non-localhost host.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a vulnerable Vitest instance with its UI server exposed to the network, running on a Windows system.\u003c/li\u003e\n\u003cli\u003eAttacker obtains the API token by sending a request to \u003ccode\u003ehttp://localhost:51204/__vitest__/\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious request to the \u003ccode\u003e/__vitest_attachment__\u003c/code\u003e endpoint with a path traversal payload: \u003ccode\u003ehttp://localhost:51204/__vitest_attachment__?path=C:\\\\path\\\\to\\\\project\\\\?\\\\..\\\\..\\\\secret.txt\u0026amp;contentType=text/plain\u0026amp;token=$TOKEN\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eisFileServingAllowed\u003c/code\u003e check is bypassed due to the use of the \u003ccode\u003e\\\\?\\\\..\\\\\u003c/code\u003e sequence.\u003c/li\u003e\n\u003cli\u003eThe Vitest server reads the content of the specified file (\u003ccode\u003esecret.txt\u003c/code\u003e) outside the intended project directory.\u003c/li\u003e\n\u003cli\u003eThe attacker receives the content of the file in the response.\u003c/li\u003e\n\u003cli\u003eAttacker leverages the API\u0026rsquo;s rerun feature and file write feature (\u003ccode\u003esaveTestFile\u003c/code\u003e) to write a malicious test file containing arbitrary code.\u003c/li\u003e\n\u003cli\u003eAttacker uses the rerun feature to execute the newly created test file, achieving arbitrary script execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to read arbitrary files on the affected system. If the attacker is able to read sensitive files containing credentials or configuration data, it could lead to further compromise of the system or network. The ability to execute arbitrary scripts allows for full system compromise, data exfiltration, or denial-of-service attacks. This vulnerability affects any Vitest instances with UI server exposed to network and running on Windows prior to version 4.1.0\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Vitest to version 4.1.0 or later to patch CVE-2026-47429.\u003c/li\u003e\n\u003cli\u003eEnsure that the \u003ccode\u003eallowWrite\u003c/code\u003e and \u003ccode\u003eallowExec\u003c/code\u003e configuration flags are disabled when the Vitest API server is bound to a non-localhost host as per the vendor mitigations.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for suspicious requests to the \u003ccode\u003e/__vitest_attachment__\u003c/code\u003e endpoint with path traversal sequences using the Sigma rule provided below.\u003c/li\u003e\n\u003cli\u003eMonitor process creation for unexpected script execution originating from the Vitest process using the provided Sigma rule.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-06-01T14:15:03Z","date_published":"2026-06-01T14:15:03Z","id":"https://feed.craftedsignal.io/briefs/2026-06-vitest-file-read/","summary":"An arbitrary file read vulnerability exists in Vitest when the UI server is listening, especially when exposed to the network, allowing an attacker to read arbitrary files outside the project directory and potentially execute arbitrary scripts.","title":"Vitest Arbitrary File Read Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-06-vitest-file-read/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@vitest/browser"],"_cs_severities":["critical"],"_cs_tags":["xss","rce","vitest","javascript","dependency-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Vitest"],"content_html":"\u003cp\u003eThe Vitest browser mode is susceptible to a reflected cross-site scripting (XSS) vulnerability. Specifically, the \u003ccode\u003eotelCarrier\u003c/code\u003e query parameter, when passed to the \u003ccode\u003e/__vitest_test__/\u003c/code\u003e endpoint, is directly inserted into an inline module script without proper sanitization. This allows an attacker to inject arbitrary JavaScript code that executes within the Vitest server\u0026rsquo;s origin. The generated page also contains \u003ccode\u003eVITEST_API_TOKEN\u003c/code\u003e, which is used for authenticating Vitest WebSocket APIs, leading to potential token compromise and authenticated API calls. This issue affects Vitest versions \u0026gt;= 4.0.17 and \u0026lt; 4.1.6, as well as \u0026gt;= 5.0.0-beta.0 and \u0026lt; 5.0.0-beta.3, impacting users running Vitest browser mode. A successful exploit requires a victim to open a crafted Vitest browser-runner URL while the Vitest browser server is active.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker crafts a malicious URL targeting the \u003ccode\u003e/__vitest_test__/\u003c/code\u003e endpoint, embedding JavaScript code within the \u003ccode\u003eotelCarrier\u003c/code\u003e query parameter.\u003c/li\u003e\n\u003cli\u003eThe victim opens the attacker-crafted URL in a web browser while the Vitest browser server is running.\u003c/li\u003e\n\u003cli\u003eThe Vitest server reflects the unsanitized \u003ccode\u003eotelCarrier\u003c/code\u003e parameter directly into an inline module script within the generated HTML page.\u003c/li\u003e\n\u003cli\u003eThe injected JavaScript executes within the victim\u0026rsquo;s browser, in the Vitest server origin.\u003c/li\u003e\n\u003cli\u003eThe attacker\u0026rsquo;s script accesses \u003ccode\u003ewindow.VITEST_API_TOKEN\u003c/code\u003e, compromising the Vitest WebSocket API token.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the compromised API token to authenticate with the Vitest WebSocket API endpoint at \u003ccode\u003e/__vitest_browser_api__\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker calls the \u003ccode\u003etriggerCommand\u003c/code\u003e function via the WebSocket to write a malicious payload into the \u003ccode\u003evite.config.ts\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eVitest/Vite reloads the modified configuration file, resulting in the execution of the injected code within the Node.js environment, achieving remote code execution (RCE).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to execute arbitrary JavaScript code within the Vitest server\u0026rsquo;s origin. In a default local browser-mode setup, this XSS can be leveraged to compromise the Vitest API token, leading to server-side code execution. A confirmed proof of concept demonstrates modifying \u003ccode\u003evite.config.ts\u003c/code\u003e to execute arbitrary code in Node. This issue poses a significant risk to developers and CI/CD environments using Vitest in browser mode.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the patch or upgrade to a non-vulnerable version of \u003ccode\u003e@vitest/browser\u003c/code\u003e to address CVE-2026-47428.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Detect Vitest otelCarrier Parameter Injection\u0026rdquo; to identify potential exploitation attempts by detecting suspicious characters in the \u003ccode\u003eotelCarrier\u003c/code\u003e query parameter within web server logs.\u003c/li\u003e\n\u003cli\u003eBlock access to the known malicious URLs (e.g., \u003ccode\u003ehttp://localhost:63315/__vitest_test__/?otelCarrier=(alert(%22xss%20via%20otelCarrier%22)%2Cnull)\u003c/code\u003e) listed in the IOC section at the network perimeter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-06-01T14:14:49Z","date_published":"2026-06-01T14:14:49Z","id":"https://feed.craftedsignal.io/briefs/2026-06-vitest-xss/","summary":"Vitest browser mode is vulnerable to reflected cross-site scripting (XSS) due to the `otelCarrier` query parameter being inserted directly into an inline module script without sanitization, enabling an attacker to craft a browser-runner URL that executes arbitrary JavaScript in the Vitest server origin, potentially leading to remote code execution (RCE).","title":"Vitest Browser Mode XSS via otelCarrier Parameter Leads to RCE","url":"https://feed.craftedsignal.io/briefs/2026-06-vitest-xss/"}],"language":"en","title":"CraftedSignal Threat Feed — Vitest","version":"https://jsonfeed.org/version/1.1"}