npm/@vitest/browser CVE-2026-47428: critical 9.6, EPSS 0.61%
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
Action: Upgrade @vitest/browser to 4.1.6 or later.
npm i @vitest/browser@4.1.6npm i @vitest/browser@5.0.0-beta.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.17 | 4.1.6 | - |
| 5.0.0-beta.0 | 5.0.0-beta.3 | - |
Fixed versions
| 4.1.6 | 5.0.0-beta.3 |
Sources
- osv: GHSA-2h32-95rg-cppp
- https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp
- https://github.com/vitest-dev/vitest
- https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/client/public/esm-client-injector.js#L41
- https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/node/serverOrchestrator.ts#L48
CVE-2026-47428 · published · modified · JSON