{"id":"CVE-2026-47428","sourceIdentifier":"security-advisories@github.com","published":"2026-07-14T20:17:02.307","lastModified":"2026-10-24T21:10:00.130","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3."},{"lang":"es","value":"Vitest es un framework de pruebas impulsado por Vite. Desde la versión 4.0.17 hasta la 4.1.6 y la 5.0.0-beta.3, el Modo Navegador de Vitest servía /__vitest_test__/ con el parámetro de consulta otelCarrier insertado directamente en un script de módulo en línea, permitiendo que una URL de browser-runner manipulada ejecutara JavaScript arbitrario en el origen del servidor de Vitest y recuperara el VITEST_API_TOKEN para llamadas a la API autenticadas. Este problema está solucionado en las versiones 4.1.6 y 5.0.0-beta.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vitest-dev","product":"vitest","versions":[{"version":">= 4.0.17, < 4.1.6","status":"affected"},{"version":">= 5.0.0-beta.0, < 5.0.0-beta.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-15T13:20:10.196813Z","id":"CVE-2026-47428","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/pull/10283","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/pull/10285","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/releases/tag/v4.1.6","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}