Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2025-24963 — Path Traversal in Vitest

CWE-22 — Path TraversalCWE-190 — Integer Overflow or Wraparound5 documents5 sources
Severity
7.5HIGHNVD
EPSS
23.6%
top 3.99%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
5
Vitest.dev VitestVitest BrowserVitest-dev Vitest+2 more
Timeline
PublishedFeb 4

Description

Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposi…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶npmvitest/browser2.0.4 — 2.1.9+1
▶NVDvitest.dev/vitest3.0.0 — 3.0.4+1
▶CVEListV5vitest-dev/vitest>= 2.0.4, < 2.1.9, >= 3.0.0, < 3.0.4+1

Patches

Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
Vitest browser mode serves arbitrary files↗2025-02-04
▶
OSV
Vitest browser mode serves arbitrary files↗2025-02-04
▶

💥Exploits & PoCs

1
Nuclei
Vitest Browser Mode - Local File Read
▶

📋Vendor Advisories

1
Microsoft
Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions↗2023-01-10
▶