CVE-2026-112949: Vitest Framework RCE Vulnerability

CVE-2026-112949 Overview

CVE-2026-112949 is a code injection vulnerability [CWE-94] in Vitest, a Vite-native testing framework for JavaScript and TypeScript projects. The flaw affects versions from 2.1.0-beta.7 up to 4.1.12 and 5.0.3. An unauthenticated non-browser WebSocket client that can reach a Vitest development server using interceptorPlugin can register a manual mock. The attacker-controlled url passed to createManualModuleSource is inserted unescaped into generated module source. When a developer's browser loads the affected module, attacker-controlled JavaScript executes in the development-server origin.

Critical Impact

Attackers reaching the Vitest dev server over WebSocket can inject JavaScript that runs in the developer's browser under the dev-server origin, enabling source theft, token exfiltration, and pivoting into developer environments.

Affected Products

• Vitest versions 2.1.0-beta.7 through 4.1.11
• Vitest versions 5.0.0 through 5.0.2
• Projects using the Vitest interceptorPlugin in browser mode

Discovery Timeline

• 2026-10-20 - CVE-2026-112949 published to NVD
• 2026-10-20 - Last updated in NVD database
• Fixed releases - Vitest 4.1.12 and 5.0.3 published on GitHub

Technical Details for CVE-2026-112949

Vulnerability Analysis

The vulnerability resides in createManualModuleSource within packages/mocker/src/utils.ts. The function built module source by concatenating the module URL and export names directly into a JavaScript template literal using unescaped string interpolation. Any input containing backticks, ${} sequences, or quote characters escaped the string context and became executable code in the generated module.

Because Vitest's interceptorPlugin accepts manual mock registrations over its WebSocket channel, a reachable non-browser client can submit a crafted url. When the developer's browser later imports the mocked module, the injected JavaScript executes under the dev-server origin, giving the attacker access to local source, cookies, and dev-server APIs.

Root Cause

The root cause is improper neutralization of special elements used in code [CWE-94]. The pre-patch generator produced source like getFactoryModule("${moduleUrl}") and __factoryModule__["${name}"], trusting both values to be benign strings. Neither value was escaped or JSON-encoded before interpolation.

Attack Vector

Exploitation requires network reachability to the development server WebSocket endpoint and a developer who loads the affected module in a browser. The attacker does not need credentials, but exploitation depends on user interaction and specific timing, which raises attack complexity.

// Patch to packages/mocker/src/utils.ts — JSON.stringify neutralizes injection
export function createManualModuleSource(moduleUrl: string, exports: string[], globalAccessor = '"__vitest_mocker__"'): string {
  const source = `
-const __factoryModule__ = await globalThis[${globalAccessor}].getFactoryModule("${moduleUrl}");
+const __factoryModule__ = await globalThis[${globalAccessor}].getFactoryModule(${JSON.stringify(moduleUrl)});
`
  const keys = exports
    .map((name, index) => {
-      return `let __${index} = __factoryModule__["${name}"]
-export { __${index} as "${name}" }`
+      return `let __${index} = __factoryModule__[${JSON.stringify(name)}]
+export { __${index} as ${JSON.stringify(name)} }`
    })
    .join('\n')
  let code = `${source}\n${keys}`
}

Source: vitest commit b8253132

Detection Methods for CVE-2026-112949

Indicators of Compromise

• Inbound WebSocket connections to the Vitest dev-server port from non-browser clients or unexpected network sources.
• Mock registration messages whose url field contains backticks, ${ sequences, or quote characters.
• Generated mock modules containing JavaScript outside the expected getFactoryModule and export pattern.

Detection Strategies

• Audit project dependencies for Vitest versions between 2.1.0-beta.7 and 4.1.11, or 5.0.0 through 5.0.2.
• Inspect dev-server access logs for unauthenticated WebSocket upgrades originating from outside developer workstations.
• Enable browser-side Content Security Policy reporting to surface unexpected script execution on dev-server origins.

Monitoring Recommendations

• Monitor developer host network egress for traffic to attacker-controlled infrastructure from browser tabs loading test modules.
• Alert on Vitest dev-server processes bound to non-loopback interfaces (0.0.0.0, public IPs).
• Review package.json and lockfile changes in CI for pinned Vitest versions below the patched releases.

How to Mitigate CVE-2026-112949

Immediate Actions Required

• Upgrade Vitest to 4.1.12 or 5.0.3 across all projects and CI pipelines.
• Bind Vitest dev servers to localhost only and avoid exposing the WebSocket port on shared networks or VPNs.
• Rotate any secrets, tokens, or cookies that may have been accessible from a developer browser during the exposure window.

Patch Information

The maintainers fixed the issue by routing both moduleUrl and export name values through JSON.stringify before interpolation into generated module source. See Vitest release v4.1.12, Vitest release v5.0.3, and GitHub Security Advisory GHSA-qxg6-89mg-rqv8.

Workarounds

• Restrict the Vitest dev server to loopback with server.host: '127.0.0.1' until the upgrade is deployed.
• Place developer workstations behind host firewall rules that block inbound connections to Vitest ports.
• Disable or avoid the interceptorPlugin mocking workflow on untrusted networks.

# vitest.config.ts — restrict dev server to loopback
# server:
#   host: '127.0.0.1'
#   strictPort: true
npm install --save-dev vitest@5.0.3
# or for the v4 line
npm install --save-dev vitest@4.1.12