AI description
CVE-2026-47428 describes a vulnerability found in Vitest's browser mode, specifically within the `/__vitest_test__/` route. The issue arises because the `otelCarrier` query parameter is directly embedded into an inline module script in the HTML response without proper sanitization. This oversight allows an attacker to inject arbitrary JavaScript code by crafting a malicious browser-runner URL. When a victim navigates to such a crafted URL while the Vitest browser server is active, the injected script can execute within the Vitest server's origin. This enables the attacker to recover the `VITEST_API_TOKEN`, which is used for authenticating Vitest WebSocket APIs. With this token, authenticated API calls can be made, potentially leading to server-side code execution by overwriting critical configuration files, such as `vite.config.ts`.
- Description
- Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.
- Source
- security-advisories@github.com
- NVD status
- Deferred
CVSS 3.1
- Type
- Secondary
- Base score
- 9.6
- Impact score
- 6
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Severity
- CRITICAL
- security-advisories@github.com
- CWE-79
- Hype score
- Not currently trending