CVE-2026-47428

CriticalCVSS 9.6

Published: 14/07/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

A vulnerability in Vitest Browser Mode allows JavaScript injection via the otelCarrier query parameter in the /__vitest_test__/ path. An attacker can use a crafted URL to execute arbitrary code in the Vitest server origin and recover the VITEST_API_TOKEN for authenticated API calls.

Risk Assessment

The risk involves potential theft of the API token, enabling unauthorized API calls on behalf of the Vitest server, which could compromise test integrity or lead to data leakage.

Recommendation

Immediately update Vitest to version 4.1.6 or 5.0.0-beta.3, which contain the fix for this vulnerability.

Original NVD description (English source)

Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.