Vitest: Code injection via unauthenticated manual mock registration

影響: npm:@vitest/mocker >= 2.1.0-beta.7, < 4.1.12 → 4.1.12, npm:@vitest/mocker >= 5.0.0-beta.1, < 5.0.3 → 5.0.3

@vitest/mocker's interceptorPlugin accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's url into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin. Same handler and same unauthenticated caller as GHSA-82fw-gwwq-j7x9; that fix (8ff9b9a9efca7c6cfd5243569440de8d7a33a…

在 GitHub Advisory Database 阅读

2026/10/22 04:54，GitHub Advisory Database 发布了“Vitest: Code injection via unauthenticated manual mock registration”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js。CVE：CVE-2026-112949。