{"id":"ghsa-ghsa-qxg6-89mg-rqv8","seq":53433,"kind":"advisory","title":"Vitest: Code injection via unauthenticated manual mock registration","url":"https://github.com/advisories/GHSA-qxg6-89mg-rqv8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-qxg6-89mg-rqv8","summary":"影響: npm:@vitest/mocker >= 2.1.0-beta.7, < 4.1.12 → 4.1.12, npm:@vitest/mocker >= 5.0.0-beta.1, < 5.0.3 → 5.0.3\nSummary @vitest/mocker's interceptorPlugin accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's url into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin. Same handler and same unauthenticated caller as GHSA-82fw-gwwq-j7x9; that fix (8ff9b9a9efca7c6cfd5243569440de8d7a33a…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-112949"],"tags":["GHSA-qxg6-89mg-rqv8","@vitest/mocker","@vitest/mocker"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T19:54:26.000Z","fetched_at":"2026-10-21T20:20:51.598Z"}