Medium
Vitest: Code injection via unauthenticated manual mock registration
Type: advisorySources: OSV
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-112949
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 12:28 UTC · Revision 1
Source evidence
Vitest: Code injection via unauthenticated manual mock registration
core-osv · Original sourcePublished 20 Oct 2026, 15:19 UTC
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.
osv:CVE-2026-112949
Complete source record
{
"id": "d1a7346c6226391bfb0e7c17e30b6a3122d13fdee3fe62d71aa668bc9dc74d52",
"url": "https://osv.dev/vulnerability/CVE-2026-112949",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Vitest: Code injection via unauthenticated manual mock registration",
"summary": "Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.",
"evidence": "osv:CVE-2026-112949",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-112949",
"aliases": [
"CVE-2026-112949",
"GHSA-qxg6-89mg-rqv8"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/vitest-dev/vitest",
"type": "GIT",
"events": [
{
"introduced": "b2be23e4c901c1667c94c8119dfe94b6063e6d30"
},
{
"fixed": "4766ce1e72ded629d3a37637f57eeae643789a8c"
},
{
"introduced": "f441c6fab25e579c5b7dd3dd50538416f415fbae"
},
{
"fixed": "33cadea62e8763c455c7fca38d9ab1dda87c5f75"
},
{
"fixed": "15cc006aa9f8683dc5f7e895d011fa7dc751ce35"
},
{
"fixed": "b825313243dc55757e8d7c0f9e7a792135e13473"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "2.1.0-beta.7"
},
{
"fixed": "4.1.12"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "15cc006aa9f8683dc5f7e895d011fa7dc751ce35"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "b825313243dc55757e8d7c0f9e7a792135e13473"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "4766ce1e72ded629d3a37637f57eeae643789a8c"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v4.1.12"
},
{
"range": [
{
"fixed": "33cadea62e8763c455c7fca38d9ab1dda87c5f75"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v5.0.3"
}
]
}
}
],
"versions": [
"v5.0.2",
"v5.0.1",
"v5.0.0",
"v4.1.11",
"v4.1.10",
"v4.1.9",
"v4.1.8",
"v4.1.7",
"v4.1.6",
"v4.1.5",
"v4.1.4",
"v4.1.3",
"v4.1.2",
"v4.1.1",
"v4.1.0",
"v4.1.0-beta.6",
"v4.1.0-beta.5",
"v4.1.0-beta.4",
"v4.1.0-beta.3",
"v4.0.17",
"v4.1.0-beta.2",
"v4.1.0-beta.1",
"v4.0.16",
"v4.0.15",
"v4.0.14",
"v4.0.13",
"v4.0.12",
"v4.0.11",
"v4.0.10",
"v4.0.9",
"v4.0.8",
"v4.0.7",
"v4.0.6",
"v4.0.5",
"v4.0.4",
"v4.0.3",
"v4.0.2",
"v4.0.1",
"v4.0.0",
"v4.0.0-beta.19",
"v4.0.0-beta.18",
"v4.0.0-beta.17",
"v4.0.0-beta.16",
"v4.0.0-beta.15",
"v4.0.0-beta.14",
"v4.0.0-beta.13",
"v3.2.4",
"v4.0.0-beta.12",
"v4.0.0-beta.11",
"v4.0.0-beta.10",
"v4.0.0-beta.9",
"v4.0.0-beta.8",
"v4.0.0-beta.7",
"v4.0.0-beta.6",
"v4.0.0-beta.5",
"v4.0.0-beta.4",
"v4.0.0-beta.3",
"v4.0.0-beta.2",
"v4.0.0-beta.1",
"v3.2.3",
"v3.2.2",
"v3.2.1",
"v3.2.0",
"v3.2.0-beta.3",
"v3.1.3",
"v3.2.0-beta.2",
"v3.2.0-beta.1",
"v3.1.2",
"v3.1.1",
"v3.1.0",
"v3.1.0-beta.2",
"v3.1.0-beta.1",
"v3.0.9",
"v3.0.8",
"v3.0.7",
"v3.0.6",
"v3.0.5",
"v3.0.4",
"v3.0.3",
"v3.0.2",
"v3.0.1",
"v3.0.0",
"v3.0.0-beta.4",
"v3.0.0-beta.3",
"v3.0.0-beta.2",
"v3.0.0-beta.1",
"v2.1.5",
"v2.2.0-beta.2",
"v2.2.0-beta.1",
"v2.1.4",
"v2.1.3",
"v2.1.2",
"v2.1.1",
"v2.1.0",
"v2.1.0-beta.7"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112949.json"
}
}
],
"modified": "2026-10-28T02:30:28.455496466Z",
"provider": "osv",
"references": [
"https://github.com/vitest-dev/vitest/releases/tag/v4.1.12",
"https://github.com/vitest-dev/vitest/releases/tag/v5.0.3",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112949.json",
"https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8",
"https://nvd.nist.gov/vuln/detail/CVE-2026-112949",
"https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35",
"https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473"
],
"provider_metadata": {
"cwe_ids": [
"CWE-116",
"CWE-306",
"CWE-94"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112949.json"
}
},
"related_cves": [
{
"value": "CVE-2026-112949",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 495373,
"published_at": "2026-10-20T15:19:03.799+00:00"
}