CVE-2025-24963

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-24963
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-24963.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-24963
Aliases
Published
2025-02-04T19:36:52.385Z
Modified
2026-01-03T09:49:36.344556Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Browser mode serves arbitrary files in vitest
Details

Vitest is a testing framework powered by Vite. The __screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get the content of arbitrary files.This __screenshot-error handler on the browser mode HTTP server responds any file on the file system. This code was added by commit 2d62051. Users explicitly exposing the browser mode server to the network by browser.api.host: true may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24963.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/vitest-dev/vitest

Affected ranges

Type
GIT
Repo
https://github.com/vitest-dev/vitest
Events
Introduced
400481f64d7a30a426ac072c0d5498e404fc0113
Fixed
c9e59a089d94642eea29a43f2ee1986a5afb99c6
Database specific 
{
    "versions": [
        {
            "introduced": "2.0.4"
        },
        {
            "fixed": "2.1.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/vitest-dev/vitest
Events
Introduced
01600e04c2252abee78fc8a695197ce62f2846d4
Fixed
9e404375825d870ed9d90db854d96f77a7abeaff
Database specific 
{
    "versions": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.4"
        }
    ]
}

Affected versions

v2.*

v2.0.4
v2.0.5
v2.1.0
v2.1.0-beta.1
v2.1.0-beta.2
v2.1.0-beta.3
v2.1.0-beta.4
v2.1.0-beta.5
v2.1.0-beta.6
v2.1.0-beta.7
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8

v3.*

v3.0.0
v3.0.1
v3.0.2
v3.0.3

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-24963.json"