CVE-2026-47428
Critical · 9.6CVSS
9.6
EPSS
0.6%
Published
Jul 14, 2026
CISA due date
—
The record
Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @vitest/browser | 4.0.17 | 4.1.6 |
| npm | @vitest/browser | 5.0.0-beta.0 | 5.0.0-beta.3 |
Related vulnerabilities
- GHSA-2h32-95rg-cppp Vitest browser mode serves unsanitized otelCarrier query parameter as inline script Same vulnerability
- CVE-2026-53633 Vitest is a testing framework powered by Vite. Also affects @vitest/browser
- GHSA-g8mr-85jm-7xhm Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files… Also affects @vitest/browser
- CVE-2026-62990 Shopper is a Headless e-commerce Admin Panel. CWE-79
- CVE-2026-117645 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')… CWE-79
- CVE-2026-94175 Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. CWE-79
- CVE-2026-7004 WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site… CWE-79
- CVE-2026-54855 Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. CWE-79