Vitest browser mode serves arbitrary files
RSS Feed
MODERATE
GHSA-8gvc-j273-4wm5
CVE-2025-24963
Description:
Summary
__screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get the content of arbitrary files.
Details
This __screenshot-error handler on the browser mode HTTP server responds any file on the file system.
https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130
This code was added by https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f.
PoC
- Create a directory and change the current directory to that directory
- Run
npx vitest init browser - Run
npm run test:browser - Run
curl http://localhost:63315/__screenshot-error?file=/path/to/any/file
Impact
Users explicitly exposing the browser mode server to the network by browser.api.host: true may get any files exposed.
Affected Packages
| Ecosystem | Package | Vulnerable Versions | Patched Version |
|---|---|---|---|
| npm |
@vitest/browser
|
>= 3.0.0, < 3.0.4>= 2.0.4, < 2.1.9 |
3.0.4
|
chore(deps): bump the minor-and-patch group across 1 directory with 25 updates
Open about 9 hours ago
pythonh06719/- #4
npm:vitest
npm:@tanstack/react-query
+22 more
Build(deps): Bump the npm_and_yarn group across 1 directory with 5 updates
Closed 4 months ago
BEKO2210/HinSchG #43
npm:vitest
npm:vite
+3 more
Bump the npm_and_yarn group across 11 directories with 4 updates
Open 4 months ago
BY-SOMMER/vercel #84
npm:vitest
npm:better-auth
+1 more
Bump the npm_and_yarn group across 12 directories with 4 updates
Closed 4 months ago
BY-SOMMER/vercel #79
npm:vitest
npm:better-auth
+1 more
chore(deps): bump the npm_and_yarn group across 4 directories with 4 updates
Closed 4 months ago
tknatwork/nid-industry-interface #1
npm:vitest
npm:next
+2 more
build(deps): bump the npm_and_yarn group across 1 directory with 5 updates
Closed 4 months ago
prof-guifonseca/gota-certa #38
npm:vitest
npm:vite
+3 more
build(deps): bump the pnpm-workspace group across 1 directory with 6 updates
Closed 4 months ago
Gabriel382/openmimicry #40
npm:vitest
npm:@vitest/coverage-v8
+4 more
build(deps-dev): Bump the dev-dependencies group with 4 updates
Open 4 months ago
barryroodt/wrily #9
npm:vitest
npm:@types/node
+2 more
Bump the npm_and_yarn group across 1 directory with 26 updates
Open 4 months ago
FacePrintPay/bolt.new #1
npm:vitest
npm:tar-fs
+16 more
Bump vitest from 2.1.2 to 2.1.9 in /backend
Open 4 months ago
Biligo7/RAFINAI #2
npm:vitest
build(deps): bump the backend-minor-patch group in /novaRewards/backend with 11 updates
Closed 5 months ago
milah-247/Nova-Rewards #818
npm:nodemailer
npm:helmet
+3 more
chore(deps-dev): bump vitest from 2.1.8 to 2.1.9
Closed 5 months ago
Helixar-AI/helixar-mcp #3
npm:vitest
chore(deps-dev): bump vitest from 3.0.2 to 3.0.5 in /packages/app-core/test/contracts/lib/openzeppelin-contracts in the npm_and_yarn group across 1 directory
Open 5 months ago
elizaOS/eliza #6793
npm:vitest
build(deps): bump the npm_and_yarn group across 7 directories with 19 updates
Open 5 months ago
loveyou001/excalidraw #5
npm:vitest
npm:firebase
+15 more
Bump the npm_and_yarn group across 1 directory with 23 updates
Open 5 months ago
mocimoda/cloudflare-docs #8
npm:vitest
npm:astro
+15 more
Bump the npm_and_yarn group across 1 directory with 23 updates
Open 5 months ago
Appel420/cloudflare-docs #4
npm:vitest
npm:astro
+15 more
chore(deps): bump the npm_and_yarn group across 6 directories with 13 updates
Closed 5 months ago
Jackblanket847/svelte.dev #11
npm:vitest
npm:vite
+5 more
build(deps): bump the npm_and_yarn group across 5 directories with 18 updates
Open 5 months ago
loveyou001/excalidraw #2
npm:vitest
npm:firebase
+15 more
build(deps-dev): Bump vitest from 3.0.0 to 3.0.5 in /packages/agentmesh-integrations/copilot-governance
Closed 6 months ago
microsoft/agent-governance-toolkit #714
npm:vitest
build(deps-dev): Bump vitest from 3.0.0 to 3.0.5 in /packages/agentmesh-integrations/mastra-agentmesh
Open 6 months ago
microsoft/agent-governance-toolkit #660
npm:vitest
chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates
Closed 6 months ago
dporkka/pglite #1
npm:vitest
npm:vite
+3 more
chore(deps): bump the npm_and_yarn group across 2 directories with 18 updates
Open 6 months ago
thirdweb-dev/engine #938
npm:vitest
npm:vite
+13 more
chore(deps): bump the npm_and_yarn group across 3 directories with 9 updates
Closed 6 months ago
c6ai/vite #1
npm:vitest
npm:axios
+5 more
chore(deps): bump the dependencies group across 1 directory with 13 updates
Open 6 months ago
Flux-DeFi/LiquidFlow #87
npm:lucide-react
npm:eslint
+8 more
chore(deps): bump the npm_and_yarn group across 3 directories with 19 updates
Open 6 months ago
idgrou/crawlee #34
npm:vitest
npm:axios
+10 more
Bump the npm_and_yarn group across 7 directories with 21 updates
Closed 6 months ago
JSTONE1111/sui #27
npm:axios
npm:@babel/runtime
+10 more
chore(deps): bump the npm_and_yarn group across 3 directories with 19 updates
Closed 6 months ago
idgrou/crawlee #33
npm:vitest
npm:axios
+10 more
chore(deps): bump the npm_and_yarn group across 3 directories with 24 updates
Open 6 months ago
idgrou/crawlee #32
npm:vitest
npm:axios
+11 more
Bump the npm_and_yarn group across 1 directory with 14 updates
Open 6 months ago
YoutacRandS-VA/line-bot-sdk-nodejs #5
npm:vitest
npm:axios
+7 more
chore(deps): bump the npm_and_yarn group across 2 directories with 18 updates
Closed 6 months ago
thirdweb-dev/engine #936
npm:vitest
npm:vite
+13 more
chore(deps): bump the npm_and_yarn group across 4 directories with 12 updates
Closed 6 months ago
Jackblanket847/svelte.dev #9
npm:vitest
npm:vite
+5 more
chore(deps): bump the npm_and_yarn group across 3 directories with 27 updates
Open 6 months ago
idgrou/crawlee #30
npm:vitest
npm:axios
+12 more
build(deps): bump the npm_and_yarn group across 5 directories with 15 updates
Closed 6 months ago
hamirmahal/excalidraw #12
npm:vitest
npm:vite
+10 more
chore(deps): bump the npm_and_yarn group across 4 directories with 12 updates
Closed 6 months ago
Jackblanket847/svelte.dev #8
npm:vitest
npm:vite
+5 more
Bump the npm_and_yarn group across 1 directory with 2 updates
Open 7 months ago
au-research/raid-au #315
npm:vitest
npm:vite
build(deps): bump the npm_and_yarn group across 3 directories with 8 updates
Open 7 months ago
patrik-fredon/tauri #8
npm:vitest
npm:vite
+3 more
build(deps): bump the npm_and_yarn group across 8 directories with 10 updates
Open 7 months ago
ZoneCog/tutorialkit #11
npm:vitest
npm:astro
+3 more
chore(deps): bump the npm_and_yarn group across 4 directories with 18 updates
Closed 7 months ago
adrmarty/sui #15
npm:axios
npm:@babel/runtime
+10 more
chore(deps): bump the npm_and_yarn group across 2 directories with 27 updates
Open 7 months ago
idgrou/crawlee #28
npm:vitest
npm:axios
+12 more
chore(deps): bump the npm_and_yarn group across 4 directories with 17 updates
Closed 7 months ago
adrmarty/sui #14
npm:axios
npm:@babel/runtime
+9 more
chore(deps): bump the npm_and_yarn group across 4 directories with 17 updates
Closed 7 months ago
adrmarty/sui #13
npm:axios
npm:@babel/runtime
+9 more
Bump the npm_and_yarn group across 1 directory with 24 updates
Open 7 months ago
ZoneCog/zone.bolt #25
npm:vitest
npm:tar-fs
+19 more
Bump the npm_and_yarn group across 3 directories with 14 updates
Open 7 months ago
YoutacRandS-VA/line-bot-sdk-nodejs #4
npm:vitest
npm:axios
+7 more
build(deps): bump the npm_and_yarn group across 4 directories with 20 updates
Open 7 months ago
ASISBusiness/sui #10
npm:axios
npm:@babel/runtime
+10 more
chore(deps): bump the npm_and_yarn group across 8 directories with 14 updates
Closed 7 months ago
ssushant0011/openreplay #15
npm:webpack
npm:form-data
+8 more
chore(deps): bump the npm_and_yarn group across 6 directories with 10 updates
Open 7 months ago
UpToDate5500/workers-rs #9
npm:vitest
npm:@babel/runtime
+3 more
build(deps): bump the npm_and_yarn group across 4 directories with 21 updates
Closed 7 months ago
JohnDaWalka/sui #11
npm:axios
npm:undici
+10 more
build(deps): bump the npm_and_yarn group across 3 directories with 7 updates
Closed 7 months ago
patrik-fredon/tauri #6
npm:vitest
npm:vite
+3 more
build(deps): bump the npm_and_yarn group across 2 directories with 8 updates
Closed 7 months ago
Jackblanket847/create-electron-vite #2
npm:vitest
npm:cross-spawn
+4 more
build(deps): bump the npm_and_yarn group across 4 directories with 20 updates
Closed 7 months ago
ASISBusiness/sui #7
npm:axios
npm:@babel/runtime
+10 more
Actions
Advisory Details
| Published: | February 04, 2025 over 1 year ago |
| Updated: | September 12, 2026 4 days ago |
| CVSS Score: | 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS: | 2.40% 83th percentile |
| Source: | Github |
| Classification: | GENERAL |
| UUID: | GSA_kwCzR0hTQS04Z3ZjLWoyNzMtNHdtNc4ABEIy |
PR Statistics
PR Status
Open
327 (53.5%)
Merged
62 (10.1%)
Closed
222 (36.3%)
Update Types
Major
257 (8.2%)
Minor
1306 (41.4%)
Patch
1580 (50.1%)
References
- https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5
- https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f
- https://github.com/vitest-dev/vitest/commit/ed9aeba212df04b83ed01810780663ff2cdd0adf
- https://nvd.nist.gov/vuln/detail/CVE-2025-24963
- https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130
- https://vitest.dev/guide/browser/config.html#browser-api
- https://github.com/advisories/GHSA-8gvc-j273-4wm5