VDB
CVE-2026-112949
CVE-2026-112949
PUBLISHED
CVSS 4.699999809265137 MEDIUM
Vitest: Code injection via unauthenticated manual mock registration
EPSS 0.34% · 27.0th percentile
Risk Scores
CVSS 3.1
4.699999809265137
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
0.34%
27.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| vitest | vitest | |
| wolfi | renovate | 0 |
| @vitest | mocker | 2.1.0-beta.7, 5.0.0 |
| vitest | mocker | 2.1.0-beta.7, 5.0.0-beta.1 |
| wolfi | vitess-24 | 0 |
| chainguard | langfuse-fips-4 | 0 |
| vitest-dev | vitest | 2.1.0-beta.7, 5.0.0 |
| chainguard | renovate | 0 |
| chainguard | langfuse-4 | 0 |
Timeline
- Oct 20, 2026 Coalition ESS Score
- Oct 20, 2026 CVE Published
- Oct 21, 2026 CVE Updated
- Oct 21, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 Security Advisory
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-112949 advisory
- https://github.com/advisories/GHSA-qxg6-89mg-rqv8 advisory
- https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8 url
- https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35 patch
- https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473 patch
- https://github.com/vitest-dev/vitest/releases/tag/v4.1.12 url
- https://github.com/vitest-dev/vitest/releases/tag/v5.0.3 url