Unauthenticated WebSocket Vulnerability in Vitest Testing Framework
CVE-2026-112949
What is CVE-2026-112949?
A critical security flaw exists in the Vitest testing framework, impacting versions from 2.1.0-beta.7 through 4.1.12 and 5.0.3. This issue arises from an unauthenticated non-browser WebSocket client capable of interacting with a development server via the interceptorPlugin. Malicious actors can create manual mocks using the createManualModuleSource method, which allows for the insertion of unsanitized URLs directly into the generated module source code. As a result, when the developer's browser accesses the affected module, it inadvertently executes JavaScript controlled by the attacker on the development server's origin. Users are strongly encouraged to upgrade to versions 4.1.12 or 5.0.3 to mitigate this vulnerability.
Affected Version(s)
mocker >= 2.1.0-beta.7, < 4.1.12 < 2.1.0-beta.7, 4.1.12
mocker >= 5.0.0, < 5.0.3 < 5.0.0, 5.0.3
vitest >= 2.1.0-beta.7, < 4.1.12 < 2.1.0-beta.7, 4.1.12