CVE-2026-47428

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score

9.6 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H                                    

Vulnerability Description

Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.

Vulnerability Details

Published Date

June 01, 2026

Last Modified

July 15, 2026

CWE ID

CWE-79

Source

GitHub

Vendor

npm

Product

@vitest/browser

External References

https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp
https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/client/public/esm-client-injector.js#L41
https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/node/serverOrchestrator.ts#L48
https://github.com/advisories/GHSA-2h32-95rg-cppp

CVE-2026-47428

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment