CVE-2026-47428: Vitest Browser Mode RCE Vulnerability

CVE-2026-47428 Overview

CVE-2026-47428 is a cross-site scripting (XSS) vulnerability in Vitest, a testing framework powered by Vite. The flaw affects Vitest Browser Mode from version 4.0.17 until 4.1.6 and 5.0.0-beta.3. The /__vitest_test__/ endpoint inserted the otelCarrier query parameter directly into an inline module script without sanitization. A crafted browser-runner URL can execute arbitrary JavaScript in the Vitest server origin and recover the VITEST_API_TOKEN used for authenticated API calls. The issue is fixed in versions 4.1.6 and 5.0.0-beta.3.

Critical Impact
Attackers can execute arbitrary JavaScript in the Vitest server origin and exfiltrate the VITEST_API_TOKEN, enabling authenticated API access to the developer's test infrastructure.

Affected Products

Vitest 4.0.17 through 4.1.5 (Browser Mode)
Vitest 5.0.0-beta.1 and 5.0.0-beta.2 (Browser Mode)
Applications and CI pipelines running vulnerable Vitest Browser Mode instances

Discovery Timeline

2026-07-14 - CVE-2026-47428 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47428

Vulnerability Analysis

The vulnerability resides in the Vitest Browser Mode orchestrator, specifically in packages/browser/src/node/serverOrchestrator.ts. When serving the /__vitest_test__/ endpoint, the orchestrator constructs an inline module script that embeds runtime configuration values. One of those values, __VITEST_OTEL_CARRIER__, was populated directly from the otelCarrier URL query parameter without escaping or JSON serialization.

Because the value flows into a <script> context, an attacker who can lure a developer to a crafted Vitest browser-runner URL can break out of the intended string literal and inject arbitrary JavaScript. The injected code runs in the origin of the local Vitest server. Adjacent to the injection point, the same inline script exposes __VITEST_API_TOKEN__, which the attacker's payload can read and use to authenticate against the Vitest API. This maps to [CWE-79] Cross-site Scripting.

Root Cause

The root cause is unescaped interpolation of untrusted input into an inline script. The original code used url.searchParams.get('otelCarrier') ?? 'null', treating a user-controlled string as a raw JavaScript expression rather than a serialized data literal.

Attack Vector

Exploitation requires user interaction: the developer must load a crafted URL pointing at the running Vitest server (typically localhost). Once loaded, the injected JavaScript executes in the Vitest origin and can read the API token from the same inline script, enabling downstream authenticated API abuse.

typescript

    __VITEST_TYPE__: '"orchestrator"',
    __VITEST_SESSION_ID__: JSON.stringify(sessionId),
    __VITEST_TESTER_ID__: '"none"',
-    __VITEST_OTEL_CARRIER__: url.searchParams.get('otelCarrier') ?? 'null',
+    __VITEST_OTEL_CARRIER__: JSON.stringify(session?.otelCarrier ?? null),
    __VITEST_PROVIDED_CONTEXT__: JSON.stringify(stringify(browserProject.project.getProvidedContext())),
    __VITEST_API_TOKEN__: JSON.stringify(globalServer.vitest.config.api.token),
  })
// Source: https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06

The patch replaces the raw query parameter with a server-side session.otelCarrier value wrapped in JSON.stringify, eliminating the injection sink.

Detection Methods for CVE-2026-47428

Indicators of Compromise

HTTP requests to /__vitest_test__/ containing an otelCarrier query parameter with characters such as ", <, >, backticks, or );.
Outbound network requests from developer or CI hosts to unexpected destinations shortly after loading a Vitest browser URL.
Unexpected authenticated calls to the Vitest API using VITEST_API_TOKEN from non-local origins.

Detection Strategies

Inspect web proxy and browser telemetry for URLs matching \/__vitest_test__\/.*otelCarrier= with encoded script fragments.
Alert on Vitest processes spawning unexpected child processes or writing to non-test file paths during a test run.
Review CI job logs and developer workstation logs for Vitest Browser Mode versions between 4.0.17 and 4.1.5, or 5.0.0-beta.1/beta.2.

Monitoring Recommendations

Monitor npm and lockfile changes to track Vitest versions across repositories and build agents.
Log and retain access records for local development servers exposed beyond localhost.
Track use of VITEST_API_TOKEN and rotate the token if any suspicious activity is observed.

How to Mitigate CVE-2026-47428

Immediate Actions Required

Upgrade Vitest to 4.1.6 or 5.0.0-beta.3 across all projects, CI runners, and developer machines.
Rotate VITEST_API_TOKEN values that may have been exposed on shared or internet-reachable hosts.
Restrict the Vitest Browser Mode server to localhost and avoid binding it to public interfaces.

Patch Information

The fix is available in Vitest v4.1.6 and v5.0.0-beta.3. See the GitHub Security Advisory GHSA-2h32-95rg-cppp and pull requests #10283 and #10285 for details.

Workarounds

Do not open untrusted URLs while a Vitest Browser Mode server is running.
Bind the Vitest dev server strictly to 127.0.0.1 and block external access via host firewall rules.
Configure a strong, unique api.token per project and rotate it after upgrading.

bash

# Upgrade Vitest to a patched release
npm install --save-dev vitest@4.1.6
# or, for the 5.x line
npm install --save-dev vitest@5.0.0-beta.3

# Verify installed version
npx vitest --version