CVE Feed

    Dashboard / CVE / CVE-2026-47428

    CVE-2026-47428

    Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.

    Published:Jul 14, 2026
    Last Modified:Jul 15, 2026
    EPS:Jul 14, 2026
    EPSS Score:0.00367
    CVSS Score:9.6

    Affected Products

    Vendor
    Vitest.dev
    Product
    Vitest

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-84373 (CVSS 5.9) — Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin…
    CVE-2026-73653 (CVSS 9.4) — Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode…
    CVE-2026-53633 (CVSS 9.8) — Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser…
    CVE-2026-47429 (CVSS 9.8) — Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows u…
    CVE-2025-24963 (CVSS 5.9) — Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP serve…
    CVE-2025-24964 (CVSS 9.6) — Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Executio…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High