PT-2025-5608 · Vitest · Vitest

Sapphi-Red · Published 2025-01-29 · Updated 2026-02-19 · CVE-2025-24964

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vitest versions prior to 1.6.1 Vitest versions prior to 2.1.9 Vitest versions prior to 3.0.5

Description The issue is related to arbitrary remote code execution when accessing a malicious website while the Vitest API server is listening, due to Cross-site WebSocket hijacking (CSWSH) attacks. The Vitest API server starts a WebSocket server when the api option is enabled. This server has a saveTestFile API that can edit a test file and a rerun API that can rerun the tests. An attacker can execute arbitrary code by injecting code into a test file using the saveTestFile API and then running that file by calling the rerun API.

Recommendations For Vitest versions prior to 1.6.1, upgrade to version 1.6.1 or later. For Vitest versions prior to 2.1.9, upgrade to version 2.1.9 or later. For Vitest versions prior to 3.0.5, upgrade to version 3.0.5 or later. As a temporary workaround, consider disabling the saveTestFile and rerun APIs until a patch is available. Restrict access to the Vitest API server to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1385

Related Identifiers

BDU:2025-01160

CVE-2025-24964

GHSA-9CRC-Q9X8-HGQQ

Affected Products

Vitest

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24964.json · Exploit
• https://github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01160 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24964 · Security Note
• https://osv.dev/vulnerability/GHSA-9crc-q9x8-hgqq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-24964 · Vendor Advisory
• https://github.com/vitest-dev/vitest · Note
• https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46 · Note
• https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76 · Note
• https://github.com/vitest-dev/vitest/commit/e0fe1d81e2d4bcddb1c6ca3c5c3970d8ba697383 · Note
• https://github.com/vitest-dev/vitest/commit/7ce9fbb4972d45c6fd34c843645ef6f549bbb241 · Note
• https://github.com/vitest-dev/vitest/commit/191ef9e34c867d0efd04f49b3d38193a68e825dc · Note
• https://t.me/pentestingnews/56218 · Telegram Post
• https://twitter.com/Dinosn/status/1887712286355128379 · Twitter Post
• https://twitter.com/Komodosec/status/1898569475672424630 · Twitter Post