Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until
    4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server
    using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource
    inserts unescaped into generated module source. When the developer browser loads the affected module,
    attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions
    4.1.12 and 5.0.3. (CVE-2026-112949)

ID	Name	Product	Family	Type	Severity
476883	Chainguard: langfuse-4-worker: security update to 4.68.0-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
476883	Chainguard: langfuse-4-worker: security update to 4.68.0-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
476584	SCA: security update for @vitest/mocker (GHSA-qxg6-89mg-rqv8)	Tenable Cloud Security	SCA Checks	Local	medium
476584	SCA: security update for @vitest/mocker (GHSA-qxg6-89mg-rqv8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-112949

medium

Tenable Plugins

medium

medium

medium

medium