npm/vitest CVE-2025-24964: critical 9.6, EPSS 0.68%
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
Action: Upgrade vitest to 1.6.1 or later.
npm i vitest@1.6.1npm i vitest@2.1.9npm i vitest@3.0.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | 1.6.1 | - |
| 2.0.0 | 2.1.9 | - |
| 3.0.0 | 3.0.5 | - |
| 0 | - | 0.0.125 |
Fixed versions
| 1.6.1 | 2.1.9 | 3.0.5 |
Sources
- osv: GHSA-9crc-q9x8-hgqq
- https://github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq
- https://nvd.nist.gov/vuln/detail/CVE-2025-24964
- https://github.com/vitest-dev/vitest/commit/191ef9e34c867d0efd04f49b3d38193a68e825dc
- https://github.com/vitest-dev/vitest/commit/7ce9fbb4972d45c6fd34c843645ef6f549bbb241
- https://github.com/vitest-dev/vitest/commit/e0fe1d81e2d4bcddb1c6ca3c5c3970d8ba697383
- https://github.com/vitest-dev/vitest
- https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46
- https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76
- https://vitest.dev/config/#api
CVE-2025-24964 · published · modified · JSON