CVE-2026-112949 · GHSA-qxg6-89mg-rqv8
Vitest: Code injection via unauthenticated manual mock registration
- Risk score
- 41/100
- CVSS
- 4.7 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inser…
- Affected
- @vitest/mocker (npm) >= 2.1.0-beta.7, < 4.1.12; @vitest/mocker (npm) >= 5.0.0-beta.1, < 5.0.3
- Fix
- Upgrade @vitest/mocker to 4.1.12 or 5.0.3 (whichever matches your release line) or later.
- Exploitation
- Public proof of concept
Why it is Yellow
- CVSS 4.7 medium
- Public exploit or proof of concept referenced
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @vitest/mocker | npm | >= 2.1.0-beta.7, < 4.1.12 | 4.1.12 |
| @vitest/mocker | npm | >= 5.0.0-beta.1, < 5.0.3 | 5.0.3 |
References
- https://github.com/advisories/GHSA-qxg6-89mg-rqv8
- https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8
- https://nvd.nist.gov/vuln/detail/CVE-2026-112949
- https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35
- https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473
- https://github.com/vitest-dev/vitest/releases/tag/v4.1.12
- https://github.com/vitest-dev/vitest/releases/tag/v5.0.3
- https://github.com/advisories/GHSA-qxg6-89mg-rqv8
Original description
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.
Last activity 20 Oct 2026. Patch Forecast updates every hour.