Vitest: Code injection via unauthenticated manual mock registration
影響: npm:@vitest/mocker >= 2.1.0-beta.7, < 4.1.12 → 4.1.12, npm:@vitest/mocker >= 5.0.0-beta.1, < 5.0.3 → 5.0.3
@vitest/mocker's interceptorPlugin accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's url into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin. Same handler and same unauthenticated caller as GHSA-82fw-gwwq-j7x9; that fix (8ff9b9a9efca7c6cfd5243569440de8d7a33a…
| CVE | CVE-2026-112949 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 22. 오전 05:20 |
| 데이터 | Markdown JSON |
2026. 10. 22. 오전 04:54, GitHub Advisory Database에서 "Vitest: Code injection via unauthenticated manual mock registration"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-112949.