vitest.dev records
3 published records for vendor vitest.dev.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2
- CWE-1385 Missing Origin Validation in WebSockets1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
3 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
35Monitor | CVE-2025-24964No exploit | Remote Code Execution when accessing a malicious website while Vitest API server is listeningvitest.dev · vitest · CWE-1385 | High8.8 | — | 0.6% | Feb 4, 2025 |
31Monitor | CVE-2025-24963Proof of concept | Browser mode serves arbitrary files in vitestvitest.dev · vitest · CWE-22 | High7.5 | — | 2.4% | Feb 4, 2025 |
23Monitor | CVE-2026-47429Proof of concept | Vitest: Arbitrary file can be read and executed when Vitest UI server is listeningvitest.dev · vitest · CWE-22 | Medium5.9 | — | 1.0% | Jul 14, 2026 |
- CVE-2025-2496435Monitor
Remote Code Execution when accessing a malicious website while Vitest API server is listening
HighCVSS 8.8No exploitEPSS 0%vitest.dev · vitestFeb 4, 2025
- CVE-2025-2496331Monitor
Browser mode serves arbitrary files in vitest
HighCVSS 7.5Proof of conceptEPSS 2%vitest.dev · vitestFeb 4, 2025
- CVE-2026-4742923Monitor
Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
MediumCVSS 5.9Proof of conceptEPSS 1%vitest.dev · vitestJul 14, 2026