CVE-2026-112949 | Vulnetix

CVE-2026-112949 PUBLISHED CVSS 4.7 MEDIUM

Reported by GitHub_M · Published October 20, 2026

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.

Risk Scores

CVSS 3.1

4.7

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions
vitest-dev	vitest	>= 2.1.0-beta.7, < 4.1.12, >= 5.0.0, < 5.0.3
@vitest	mocker	>= 2.1.0-beta.7, < 4.1.12, >= 5.0.0, < 5.0.3
vitest	vitest
wolfi	renovate	0
@vitest	mocker	2.1.0-beta.7, 5.0.0
vitest	mocker	5.0.0-beta.1, 2.1.0-beta.7
wolfi	vitess-24	0
chainguard	langfuse-fips-4	0
vitest-dev	vitest	2.1.0-beta.7, 5.0.0
chainguard	renovate	0
chainguard	langfuse-4	0
chainguard	vitess-24	0

Timeline

Oct 20, 2026 Coalition ESS Score
Oct 20, 2026 CVE Published
Oct 21, 2026 CVE Updated
Oct 21, 2026 EPSS Score
Oct 25, 2026 EPSS Score
Oct 29, 2026 EPSS Score
Oct 30, 2026 Security Advisory

References

https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8 x_refsource_CONFIRM
https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35 x_refsource_MISC
https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473 x_refsource_MISC
https://github.com/vitest-dev/vitest/releases/tag/v4.1.12 x_refsource_MISC
https://github.com/vitest-dev/vitest/releases/tag/v5.0.3 x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2026-112949 advisory
https://github.com/advisories/GHSA-qxg6-89mg-rqv8 advisory

Open in Interactive Console →