CVE-2026-112949

MediumCVSS 4.7/10Last modified Oct 23, 2026

Description

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-94CWE-116CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
vitest-devvitest>= 2.1.0-beta.7, < 4.1.12; >= 5.0.0, < 5.0.3
@vitestmocker>= 2.1.0-beta.7, < 4.1.12; >= 5.0.0, < 5.0.3

References

Timeline

Published
Oct 20, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-112958.8Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege esCVE-2026-1129505.9Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed aCVE-2026-1129515.4ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rCVE-2026-1129524.3ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body { CVE-2026-1129536.0ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive fiCVE-2026-1129545.3ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection canCVE-2026-1129556.5ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer canCVE-2026-1129566.5ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuationCVE-2026-1129574.3ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRoCVE-2026-1129585.4ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carryCVE-2026-112967.5Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendeCVE-2026-1129655.5Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.