Post

We've released patches for a critical security vulnerability. We strongly encourage projects to upgrade to versions 1.6.1, 2.1.9, or 3.0.5 as soon as possible.

github.comRemote Code Execution when accessing a malicious website while Vitest API server is listening### Summary Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. ### Details When [`api` o...

4/2/25, 8:18 am27 reposts102 likes

Vitest

@vitest.dev

4 Feb 2025

The patched versions also include patches for a browser mode security vulnerability.

github.comBrowser mode serves arbitrary files### Summary `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by [`browser.api.host: true`]...

Vitest

@vitest.dev

4 Feb 2025

🙏

AriPerkkio@ariperkkio.dev

Huge thanks to @sapphi.red for helping the @vitest.dev team with these findings. Perfect collaboration between projects. 🤝