CVE-2025-24964: Vitest.dev Vitest RCE Vulnerability

CVE-2025-24964 Overview

CVE-2025-24964 is a critical remote code execution vulnerability affecting Vitest, a popular testing framework powered by Vite. The vulnerability exists in the Vitest API server's WebSocket implementation, which fails to validate the Origin header and lacks proper authorization mechanisms. This weakness enables Cross-site WebSocket Hijacking (CSWSH) attacks, allowing attackers to execute arbitrary code on systems running vulnerable versions of Vitest when the API server is listening.

When the api option is enabled (which is automatically activated by Vitest UI), Vitest starts a WebSocket server that exposes dangerous APIs including saveTestFile and rerun. An attacker can exploit this by luring a developer to visit a malicious website while Vitest is running, injecting malicious code into test files via the saveTestFile API, and then triggering execution through the rerun API.

Critical Impact

Remote code execution is possible when developers access malicious websites while the Vitest API server is active, potentially compromising development environments and source code repositories.

Affected Products

• Vitest versions prior to 1.6.1
• Vitest versions 2.x prior to 2.1.9
• Vitest versions 3.x prior to 3.0.5

Discovery Timeline

• 2025-02-04 - CVE-2025-24964 published to NVD
• 2025-12-31 - Last updated in NVD database

Technical Details for CVE-2025-24964

Vulnerability Analysis

This vulnerability stems from the insecure design of Vitest's WebSocket server implementation when the API functionality is enabled. The WebSocket server, used to facilitate communication between the Vitest UI and the testing framework, accepts connections from any origin without verification. This architectural flaw makes it susceptible to Cross-site WebSocket Hijacking (CSWSH) attacks.

The attack chain leverages two exposed WebSocket APIs:

1. saveTestFile API - Allows writing arbitrary content to test files in the project
2. rerun API - Triggers execution of test files, including any malicious code injected via saveTestFile

By combining these APIs, an attacker can achieve full remote code execution within the context of the Node.js process running Vitest. The vulnerable code can be found in the Vitest API setup implementation.

Root Cause

The root cause of CVE-2025-24964 is the absence of Origin header validation and authentication mechanisms in the Vitest WebSocket server. According to CWE-1385 (Missing Origin Validation in WebSockets), web applications that use WebSocket connections must validate the Origin header to prevent cross-origin attacks. The Vitest implementation failed to implement this security control, allowing malicious websites to establish WebSocket connections and invoke sensitive APIs. Additionally, there was no authorization mechanism to restrict which clients could call dangerous APIs like saveTestFile and rerun.

Attack Vector

The attack is network-based and requires user interaction—specifically, a developer must visit a malicious website while the Vitest API server is running on their local machine. The attack flow proceeds as follows:

1. The attacker creates a malicious web page containing JavaScript code that attempts to connect to the local Vitest WebSocket server
2. A developer running Vitest with UI or API mode enabled visits the malicious website
3. The malicious JavaScript establishes a WebSocket connection to localhost on the Vitest port
4. The attacker's script calls saveTestFile to inject malicious code into an existing test file
5. The script then calls rerun to execute the modified test file, running the injected code with full Node.js privileges

The vulnerability exploits the trust relationship between browser-based JavaScript and locally running development servers. For technical implementation details, see the Vitest WebSocket handler code and the Vitest API configuration documentation.

Detection Methods for CVE-2025-24964

Indicators of Compromise

• Unexpected modifications to test files (e.g., *.test.js, *.spec.ts) with suspicious code injections
• Unusual WebSocket connections to Vitest's API port from external origins
• Unexpected child processes spawned by the Node.js Vitest process
• Anomalous file system activity in project directories during test runs

Detection Strategies

• Monitor WebSocket connections to development tool ports for non-localhost origins
• Implement file integrity monitoring on test directories to detect unauthorized modifications
• Review browser network traffic for suspicious WebSocket connections to localhost ports
• Audit development environment logs for unexpected test file changes or reruns

Monitoring Recommendations

• Enable verbose logging for Vitest during development sessions to track API calls
• Use network monitoring tools to detect WebSocket connections from untrusted origins
• Implement endpoint detection solutions that can identify suspicious Node.js process behavior
• Consider using browser extensions that block cross-origin WebSocket connections to localhost

How to Mitigate CVE-2025-24964

Immediate Actions Required

• Upgrade Vitest to patched versions: 1.6.1, 2.1.9, or 3.0.5 or later
• Avoid running Vitest UI or API mode while browsing untrusted websites
• Disable the api configuration option if not needed for your workflow
• Review recent test file changes for any suspicious modifications

Patch Information

Vitest has released security patches that address this vulnerability by implementing proper Origin header validation and authorization mechanisms for the WebSocket server. Users should upgrade to the following versions:

• For Vitest 1.x: Upgrade to version 1.6.1 or later
• For Vitest 2.x: Upgrade to version 2.1.9 or later
• For Vitest 3.x: Upgrade to version 3.0.5 or later

For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-9crc-q9x8-hgqq.

Workarounds

• There are no known workarounds for this vulnerability; upgrading is the only effective mitigation
• As a temporary measure, avoid enabling Vitest UI or API mode during development sessions
• Run Vitest in headless mode without the API server when possible
• Use network isolation to prevent browser access to the Vitest API port

# Upgrade Vitest to the latest patched version
npm update vitest

# Or install a specific patched version
npm install vitest@3.0.5

# Verify the installed version
npx vitest --version