Vitest: Code injection via unauthenticated manual mock registration

影響: npm:@vitest/mocker >= 2.1.0-beta.7, < 4.1.12 → 4.1.12, npm:@vitest/mocker >= 5.0.0-beta.1, < 5.0.3 → 5.0.3

@vitest/mocker's interceptorPlugin accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's url into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin. Same handler and same unauthenticated caller as GHSA-82fw-gwwq-j7x9; that fix (8ff9b9a9efca7c6cfd5243569440de8d7a33a…

Read on GitHub Advisory Database

On 10/22/2026, 04:54 AM, GitHub Advisory Database published "Vitest: Code injection via unauthenticated manual mock registration" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js. CVE: CVE-2026-112949.