vitest-dev vitest

• CVE-2026-112950 Medium 5.9 Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix 0.5%
• CVE-2026-112949 Medium 4.7 Vitest: Code injection via unauthenticated manual mock registration 0.3%
• CVE-2026-112948 Medium 6.5 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file 0.4%
• CVE-2026-84373 Medium 5.9 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock 0.5%
• CVE-2026-73653 Critical 9.4 Vitest: Browser Mode provider commands bypass the file-access permission gate 0.8%
• CVE-2026-53633 Critical 9.8 Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE 0.9%
• CVE-2026-47428 Critical 9.6 Vitest browser mode serves unsanitized otelCarrier query parameter as inline script 0.6%
• CVE-2026-47429 Critical 9.8 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening 1.0%
• CVE-2025-24963 Medium 5.9 Browser mode serves arbitrary files in vitest 2.4%
• CVE-2025-24964 Critical 9.7 Remote Code Execution when accessing a malicious website while Vitest API server is listening 0.7%