CVE-2026-112949: Vitest: Code injection via unauthenticated manual mock registration
@vitest/mocker’s interceptorPlugin accepts mock registrations on Vite’s dev-server WebSocket with no authentication, and interpolates the mock’s url into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any project module, which then runs in the developer’s browser on the dev-server origin.
Same handler and same unauthenticated caller as GHSA-82fw-gwwq-j7x9; that fix (8ff9b9a9efca7c6cfd5243569440de8d7a33aec4, PR #10972) hardened only the redirect branch and left the manual branch reaching the unescaped generator.
References
- github.com/advisories/GHSA-qxg6-89mg-rqv8
- github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35
- github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473
- github.com/vitest-dev/vitest/releases/tag/v4.1.12
- github.com/vitest-dev/vitest/releases/tag/v5.0.3
- github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8
- nvd.nist.gov/vuln/detail/CVE-2026-112949
Code Behaviors & Features
Detect and mitigate CVE-2026-112949 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →