PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-112949 vitest-dev CVE debrief

CVE-2026-112949: Vitest Code Injection via Unauthenticated Manual Mock Registration. The @vitest/mocker package's interceptorPlugin accepts mock registrations on Vite's dev-server WebSocket with no authentication and interpolates the mock's url into generated module source without escaping. This allows a client that can reach the dev server to serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin. Developers using Vitest, particularly those who call mockerPlugin() or interceptorPlugin() directly, should assess exposure and update to @vitest/mocker version 4.1.12 or 5.0.3 to mitigate this vulnerability. A code

Vendor
vitest-dev
Product
@vitest/mocker
CVSS
MEDIUM 4.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-21
Advisory published
2026-10-21
Advisory updated
2026-10-21

Who should care

Developers using Vitest, particularly those who call mockerPlugin() or interceptorPlugin() directly, should assess exposure and update to @vitest/mocker version 4.1.12 or 5.0.3 to mitigate this vulnerability.

Why it matters

CVE-2026-112949 allows a client that can reach the dev server to serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin. Developers using Vitest should verify their projects' dependencies and update to @vitest/mocker version 4.1.12 or 5.0.3 to mitigate this vulnerability.

  • Arbitrary JavaScript execution in the developer's browser on the dev-server origin
  • Unauthenticated mock registrations on Vite's dev-server WebSocket
  • Code injection via manual mock registration

Technical summary

The @vitest/mocker package's interceptorPlugin accepts mock registrations on Vite's dev-server WebSocket with no authentication and interpolates the mock's url into generated module source without escaping. This allows a client that can reach the dev server to serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin. The vulnerability exists in @vitest/mocker's interceptorPlugin, which accepts unauthenticated mock registrations on Vite's dev-server WebSocket and interpolates the mock's url into generated module source without escaping. Projects that call mockerPlugin() or interceptorPlugin() directly need @vitest/mocker 4.1.12 or 5.0.3. Fixed

Defensive priority

Developers using Vitest should verify their projects' dependencies and update to @vitest/mocker version 4.1.12 or 5.0.3 to mitigate this vulnerability.

Recommended defensive actions

  • Update @vitest/mocker to version 4.1.12 or 5.0.3
  • Verify projects' dependencies for @vitest/mocker
  • Implement authentication for mock registrations on Vite's dev-server WebSocket
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in @vitest/mocker's interceptorPlugin, which accepts unauthenticated mock registrations on Vite's dev-server WebSocket and interpolates the mock's url into generated module source without escaping. This allows a client that can reach the dev server to serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-112949 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-112949

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-112949 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-112949

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Vitest: Code injection via unauthenticated manual mock registration

    Unverified legacy reference

    URL: https://storage.googleapis.com/osv-vulnerabilities/npm/GHSA-qxg6-89mg-rqv8.json

    osv_dev

  • Source reference

    Unverified legacy reference

    URL: https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/vitest-dev/vitest

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/vitest-dev/vitest/releases/tag/v4.1.12

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/vitest-dev/vitest/releases/tag/v5.0.3

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.