Vitest is a unit-testing framework for JavaScript projects that has disclosed vulnerabilities centered on its core test runner and file-handling components. The recurring exposure involves path-traversal issues and improper origin validation in WebSocket interactions, which reflect the framework's role in bridging local file access and network communication during test execution. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Vitest.Dev over time
Signals from CVEs in this vendor scope (2 CVEs).
2 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-24963HIGH Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server | Feb 4, 2025 | 7.5 | 37 | NO | YES |
CVE-2025-24964HIGH Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listen | Feb 4, 2025 | 8.8 | 27 | NO | NO |
Signals from CVEs in this vendor scope (2 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Vitest.Dev.
Media articles that mention a CVE ID that affects a product developed by Vitest.Dev — matched by CVE ID, not by vendor name.