Skip to content
@vitest
Products
| Product | CVEs | Exploited | Latest |
|---|
| mocker | 3 | – | Oct 20, 2026 |
| browser | 1 | – | Oct 20, 2026 |
| ui | 1 | – | Oct 20, 2026 |
Exploited and recent CVEs
-
CVE-2026-112950
Medium 5.9
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
0.5%
-
CVE-2026-112949
Medium 4.7
Vitest: Code injection via unauthenticated manual mock registration
0.3%
-
CVE-2026-112948
Medium 6.5
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
0.4%
-
CVE-2026-112948
Medium 6.5
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
0.4%
-
CVE-2026-84373
Medium 5.9
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
0.5%