PT-2026-45491 · Vitest · Vitest

CVE-2026-47428 · Published 2026-06-01 · Updated 2026-07-16

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vitest versions 4.0.17 through 4.1.5 Vitest versions 5.0.0-beta.0 through 5.0.0-beta.2

Description In browser mode, the software serves the '/ vitest test /' endpoint where the otelCarrier query parameter is inserted directly into an inline module script. Because this value is treated as JavaScript source rather than data, a crafted URL can execute arbitrary JavaScript in the Vitest server origin. This can be used to recover the VITEST API TOKEN, which authenticates WebSocket APIs. In local setups, this token compromise can be chained to achieve server-side code execution by using the authenticated browser API to modify the vite.config.ts file, which is then executed by Node when the configuration reloads.

Recommendations Update Vitest to version 4.1.6 or 5.0.0-beta.3.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-47428

GHSA-2H32-95RG-CPPP

RHSA-2026:39058

Affected Products

Vitest

References · 17

• 🔥 https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47428.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-47428 · Security Note
• https://osv.dev/vulnerability/GHSA-2h32-95rg-cppp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-47428 · Vendor Advisory
• https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06 · Note
• https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa · Note
• https://github.com/vitest-dev/vitest/pull/10283 · Note
• https://github.com/vitest-dev/vitest/releases/tag/v4.1.6 · Note
• https://github.com/vitest-dev/vitest/pull/10285 · Note
• https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3 · Note
• https://github.com/vitest-dev/vitest · Note
• https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/client/public/esm-client-injector.js#L41 · Note
• https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/node/serverOrchestrator.ts#L48 · Note
• https://reddit.com/r/VulnMatter/comments/1tuxafv/resumen_diario_de_vulnerabilidades_02062026 · Reddit Post