Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@vitest/mocker

3 known vulnerabilities (3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 3 medium
Registry
npm

Advisories 3

  • CVE-2026-112950Medium 5.9

    Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

    Affected: from 4.1.11, fixed in 4.1.12; from 5.0.0-rc.2, fixed in 5.0.3.

  • CVE-2026-112949Medium 4.7

    Vitest: Code injection via unauthenticated manual mock registration

    Affected: from 2.1.0-beta.7, fixed in 4.1.12; from 5.0.0-beta.1, fixed in 5.0.3.

  • CVE-2026-84373Medium 5.9

    Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

    Affected: from 2.1.0, fixed in 4.1.11; from 5.0.0-beta.1, fixed in 5.0.0-rc.2.