{"action":"Upgrade @vitest/browser to 2.1.9 or later.","affected":[{"fixed":"2.1.9","introduced":"2.0.4"},{"fixed":"3.0.4","introduced":"3.0.0"}],"component":"@vitest/browser","cve_ids":["CVE-2025-24963"],"ecosystem":"npm","epss":0.02403,"exploited":false,"fixed_versions":["2.1.9","3.0.4"],"ghsa_id":"GHSA-8gvc-j273-4wm5","id":"tcs_01M5KFCZ9A56NWR0B83FGJNANP","modified_at":"2025-02-04T22:03:47Z","published_at":"2025-02-04T16:51:08Z","references":["https://osv.dev/vulnerability/GHSA-8gvc-j273-4wm5","https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5","https://nvd.nist.gov/vuln/detail/CVE-2025-24963","https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f","https://github.com/vitest-dev/vitest/commit/ed9aeba212df04b83ed01810780663ff2cdd0adf","https://github.com/vitest-dev/vitest","https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130","https://vitest.dev/guide/browser/config.html#browser-api"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-8gvc-j273-4wm5","url":"https://osv.dev/vulnerability/GHSA-8gvc-j273-4wm5"}],"summary":"Vitest browser mode serves arbitrary files"}