## Vitest: Code injection via unauthenticated manual mock registration

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-112949
- 公開日時: 2026-10-21T19:54:26.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-qxg6-89mg-rqv8)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-qxg6-89mg-rqv8

影響: npm:@vitest/mocker >= 2.1.0-beta.7, < 4.1.12 → 4.1.12, npm:@vitest/mocker >= 5.0.0-beta.1, < 5.0.3 → 5.0.3
Summary @vitest/mocker's interceptorPlugin accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's url into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin. Same handler and same unauthenticated caller as GHSA-82fw-gwwq-j7x9; that fix (8ff9b9a9efca7c6cfd5243569440de8d7a33a…