CVE-2026-112949: Vitest: Code injection via unauthenticated manual mock registration
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vitestto a version that resolves this vulnerability.Fixed in 4.1.12 - Upgrade
Upgrade
Vitestto a version that resolves this vulnerability.Fixed in 5.0.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Development servers using Vitest's interceptorPlugin are exposed if they run a vulnerable version and can be reached by an unauthenticated non-browser WebSocket client. The issue affects versions from 2.1.0-beta.7 up to, but not including, 4.1.12 and 5.0.3.
What must an attacker do to trigger code execution?
The attacker must be able to connect to the development server over WebSocket and register a manual mock with an attacker-controlled URL. Execution occurs when a developer's browser loads the affected generated module.
What is the impact of successful exploitation?
Attacker-controlled JavaScript executes on the development-server origin in the developer's browser. The stated impacts are limited confidentiality and integrity effects, with no availability impact.
What should teams do if they cannot patch immediately?
Limit access to affected development servers so unauthenticated non-browser WebSocket clients cannot reach them, and avoid exposing servers using interceptorPlugin to untrusted networks. Upgrade to 4.1.12 or 5.0.3 when possible.