PT-2025-5607 · Vitest · Vitest

Sapphi-Red · Published 2025-02-04 · Updated 2025-12-31 · CVE-2025-24963

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Vitest versions prior to 2.1.9 Vitest versions prior to 3.0.4

Description: The screenshot-error handler on the browser mode HTTP server responds to any file on the file system. If the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get the content of arbitrary files. This issue allows attackers to read arbitrary files on the system.

Recommendations: For versions prior to 2.1.9, update to version 2.1.9 or later. For versions prior to 3.0.4, update to version 3.0.4 or later. As a temporary workaround, consider disabling the browser.api.host: true configuration to prevent exposure of the browser mode server to the network. Restrict access to the screenshot-error handler to minimize the risk of exploitation. Avoid using the file parameter in the screenshot-error handler until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-24963

GHSA-8GVC-J273-4WM5

Affected Products

Vitest

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24963.json · Exploit
• https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5 · Vendor Advisory
• https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f · Patch
• https://osv.dev/vulnerability/CVE-2025-24963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24963 · Security Note
• https://osv.dev/vulnerability/GHSA-8gvc-j273-4wm5 · Vendor Advisory
• https://github.com/vitest-dev/vitest · Note
• https://github.com/vitest-dev/vitest/commit/ed9aeba212df04b83ed01810780663ff2cdd0adf · Note
• https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130 · Note
• https://twitter.com/CVEnew/status/1886864883309789500 · Twitter Post
• https://twitter.com/hackergautam/status/1891042589047943625 · Twitter Post
• https://twitter.com/dephlow98/status/1891140027029102770 · Twitter Post
• https://t.me/brutsecurity/1534 · Telegram Post
• https://t.me/cveNotify/147320 · Telegram Post
• https://vitest.dev/guide/browser/config.html#browser-api · Note