vitest (npm)
Next generation testing framework powered by Vite.
Advisories
12
Latest version
5.0.5
Released Oct 15, 2026
License
MIT
OpenSSF Scorecard
—
How to fix
Upgrading to 5.0.0-rc.2 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install vitest@5.0.5yarn
yarn add vitest@5.0.5pnpm
pnpm add vitest@5.0.5Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-82fw-gwwq-j7x9 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock |
Medium EPSS 0.53% |
>= 2.1.0, < 4.1.11 | 4.1.11 |
| GHSA-82fw-gwwq-j7x9 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock |
Medium EPSS 0.53% |
>= 5.0.0-beta.1, < 5.0.0-rc.2 | 5.0.0-rc.2 |
| GHSA-82fw-gwwq-j7x9 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock |
Medium EPSS 0.53% |
>= 2.1.0, < 4.1.11 | 4.1.11 |
| GHSA-82fw-gwwq-j7x9 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock |
Medium EPSS 0.53% |
>= 5.0.0-beta.1, < 5.0.0-rc.2 | 5.0.0-rc.2 |
| GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed |
Medium EPSS 0.88% |
>= 4.0.0, < 4.1.0 | 4.1.0 |
| GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed |
Medium EPSS 0.88% |
< 3.2.6 | 3.2.6 |
| GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed |
Medium EPSS 0.88% |
>= 4.0.0, < 4.1.0 | 4.1.0 |
| GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed |
Medium EPSS 0.88% |
< 3.2.6 | 3.2.6 |
| GHSA-9crc-q9x8-hgqq Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening |
High EPSS 0.68% |
>= 1.0.0, < 1.6.1 | 1.6.1 |
| GHSA-9crc-q9x8-hgqq Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening |
High EPSS 0.68% |
>= 2.0.0, < 2.1.9 | 2.1.9 |
| GHSA-9crc-q9x8-hgqq Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening |
High EPSS 0.68% |
>= 3.0.0, < 3.0.5 | 3.0.5 |
| GHSA-9crc-q9x8-hgqq Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening |
High EPSS 0.68% |
<= 0.0.125 | No fix yet |
Source: git+https://github.com/vitest-dev/vitest.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor