CVE-2026-47428

Name of the Vulnerable Software and Affected Versions Vitest versions 4.0.17 through 4.1.5 Vitest versions 5.0.0-beta.0 through 5.0.0-beta.2

Description In browser mode, the software serves the '/ vitest test /' endpoint where the otelCarrier query parameter is inserted directly into an inline module script. Because this value is treated as JavaScript source rather than data, a crafted URL can execute arbitrary JavaScript in the Vitest server origin. This can be used to recover the VITEST API TOKEN, which authenticates WebSocket APIs. In local setups, this token compromise can be chained to achieve server-side code execution by using the authenticated browser API to modify the vite.config.ts file, which is then executed by Node when the configuration reloads.

Recommendations Update Vitest to version 4.1.6 or 5.0.0-beta.3.