npmPackage

vitest

3 known vulnerabilities (2 critical, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

CVE-2026-84373
Affects 2.1.0 to 4.1.10 (4.1.11 is outside it); 5.0.0-beta.1 to 5.0.0-rc.1 (5.0.0-rc.2 is outside it)
CVE-2026-47429
Affects 0.0.0 to 3.2.5 (3.2.6 is outside it); 4.0.0 to 4.1.0-beta.6 (4.1.0 is outside it)
CVE-2025-24964
Affects 0.0.0 to 0.0.125 (0.0.126 is outside it); 1.0.0 to 1.6.0 (1.6.1 is outside it); 2.0.0 to 2.1.8 (2.1.9 is outside it); 3.0.0 to 3.0.4 (3.0.5 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-84373Medium 5.9
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
Affected: from 2.1.0, fixed in 4.1.11; from 5.0.0-beta.1, fixed in 5.0.0-rc.2.
Fixed in 4.1.11 (released Aug 18, 2026, 14 days before disclosure) and 5.0.0-rc.2 (released Aug 17, 2026, 15 days before disclosure).
The latest release, 5.1.0, is not affected.
42% of vitest downloads last week were affected versions (77.6M).
CVE-2026-47429Critical 9.8
Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
Affected: from 4.0.0, fixed in 4.1.0; fixed in 3.2.6.
Fixed in 3.2.6 (released Jun 1, 2026, 43 days before disclosure) and 4.1.0 (released Mar 12, 2026, 124 days before disclosure).
The latest release, 5.1.0, is not affected.
20% of vitest downloads last week were affected versions (37.6M).
CVE-2025-24964Critical 9.7
Remote Code Execution when accessing a malicious website while Vitest API server is listening
Affected: from 1.0.0, fixed in 1.6.1; from 2.0.0, fixed in 2.1.9; from 3.0.0, fixed in 3.0.5; through 0.0.125.
Fixed in 1.6.1 (released Feb 3, 2025, 1 day before disclosure), 2.1.9 (released Feb 3, 2025, 1 day before disclosure) and 3.0.5 (released Feb 3, 2025, 1 day before disclosure).
The latest release, 5.1.0, is not affected.
1.7% of vitest downloads last week were affected versions (3.2M).