CVE-2025-24963

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-24963

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

V

itest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References
Link Resource
https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130 Product
https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f Patch
https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5 Vendor Advisory
https://vitest.dev/guide/browser/config.html#browser-api Product
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:node.js:*:*
cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:node.js:*:*
History

31 Dec 2025, 14:44

Type Values Removed Values Added
CPE cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:node.js:*:*
First Time Vitest.dev vitest
Vitest.dev
References () https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130 - () https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130 - Product
References () https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f - () https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f - Patch
References () https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5 - () https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5 - Vendor Advisory
References () https://vitest.dev/guide/browser/config.html#browser-api - () https://vitest.dev/guide/browser/config.html#browser-api - Product
Summary
  • (es) Vitest es un framework de prueba desarrollado por Vite. El controlador `__screenshot-error` en el servidor HTTP en modo navegador que responde a cualquier archivo en el archivo sistema. Especialmente si el servidor está expuesto en la red por `browser.api.host: true`, un atacante puede enviar una solicitud a ese controlador desde el control remoto para obtener el contenido de archivos arbitrarios. Este controlador `__screenshot-error` en el servidor HTTP en modo navegador responde a cualquier archivo en el tallo sistema. Este código fue agregado por commit `2d62051`. Los usuarios que expongan explícitamente el servidor en modo navegador a la red por `browser.api.host: true` pueden exponer cualquier archivo. Este problema se ha solucionado en las versiones 2.1.9 y 3.0.4. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad.

04 Feb 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-04 20:15

Updated : 2025-12-31 14:44

NVD link : CVE-2025-24963

Mitre link : CVE-2025-24963

CVE.ORG link : CVE-2025-24963

JSON object : View

Products Affected

vitest.dev

CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')