CVE-2025-24964

CVE-2025-24964 describes a critical Cross-site WebSocket Hijacking (CSWSH) vulnerability in Vitest, a testing framework, affecting versions prior to 1.6.1, 2.1.9, and 3.0.5. This flaw allows an attacker to achieve arbitrary remote code execution when a user accesses a malicious website while the Vitest API server is active, particularly when the 'api' option (enabled by Vitest UI) is in use. The vulnerability stems from the WebSocket server's lack of Origin header validation and authorization, enabling an attacker to inject and execute code via the saveTestFile and rerun APIs. With a CVSS score of 8.8 (High), this vulnerability presents a significant risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in the KEV catalog.