When Vitest UI server is listening, arbitrary file can be read and executed
Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network.
Advisories for Npm/Vitest package
2026
2025
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks.