{"action":"Upgrade vitest to 1.6.1 or later.","affected":[{"fixed":"1.6.1","introduced":"1.0.0"},{"fixed":"2.1.9","introduced":"2.0.0"},{"fixed":"3.0.5","introduced":"3.0.0"},{"introduced":"0","last_affected":"0.0.125"}],"component":"vitest","cve_ids":["CVE-2025-24964"],"ecosystem":"npm","epss":0.00682,"exploited":false,"fixed_versions":["1.6.1","2.1.9","3.0.5"],"ghsa_id":"GHSA-9crc-q9x8-hgqq","id":"tcs_01M5KFFJSR9ZH34DX8HMDTSFFQ","modified_at":"2025-02-04T22:04:09Z","published_at":"2025-02-04T17:00:57Z","references":["https://osv.dev/vulnerability/GHSA-9crc-q9x8-hgqq","https://github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq","https://nvd.nist.gov/vuln/detail/CVE-2025-24964","https://github.com/vitest-dev/vitest/commit/191ef9e34c867d0efd04f49b3d38193a68e825dc","https://github.com/vitest-dev/vitest/commit/7ce9fbb4972d45c6fd34c843645ef6f549bbb241","https://github.com/vitest-dev/vitest/commit/e0fe1d81e2d4bcddb1c6ca3c5c3970d8ba697383","https://github.com/vitest-dev/vitest","https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46","https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76","https://vitest.dev/config/#api"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-9crc-q9x8-hgqq","url":"https://osv.dev/vulnerability/GHSA-9crc-q9x8-hgqq"}],"summary":"Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening"}