CVE-2026-112949
Fixed in a distro release EPSS <1%CVSS 4.7
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.
Products: vitest-dev vitest, @vitest mocker
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | @vitest/mocker | 4.1.12 |
| npm | @vitest/mocker | 5.0.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.9-r0 |
| Chainguard | gitlab-rails-ce-19.2 | no fix |
| Chainguard | gitlab-rails-ce-19.4 | no fix |
| Chainguard | gitlab-rails-ce-19.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.9-r2 |
| Chainguard | langfuse-4-worker | 4.68.0-r0 |
| Chainguard | langfuse-fips-4-worker | no fix |
| Chainguard | langfuse-fips-4-worker | 4.68.0-r0 |
| Chainguard | renovate | 44.178.1-r0 |
| Chainguard | vitess-22 | no fix |
| Chainguard | vitess-24 | 24.0.5-r3 |
| Wolfi | renovate | 44.178.1-r0 |
| Wolfi | vitess-24 | 24.0.5-r3 |