vitest

5.0.5 · 15 Oct 2026MIT77.5M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Paste your package.json, or type the range you declare for vitest. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	5.0.5	No known advisory
	4.1.12	Safe from 4.1.11
	3.2.7	1 open advisory, worst moderate
	2.1.9	38 open advisories, worst critical · last release Feb 2025, no longer updated

Your version

Critical
When Vitest UI server is listening, arbitrary file can be read and executedGHSA-5xrq-8626-4rwp · 1 Jun 2026
- 4.x4.0.0 – 4.0.18Fixed in 4.1.0
- 3.x3.0.0 – 3.2.5Fixed in 3.2.6
- 2.x and older0.0.0 – 2.1.9No fix, no longer updated · move to 3.2.6
Critical
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listeningGHSA-9crc-q9x8-hgqq · 4 Feb 2025
- 3.x3.0.0 – 3.0.4Fixed in 3.0.5
- 2.x2.0.0 – 2.1.8Fixed in 2.1.9
- 1.x1.0.0 – 1.6.0Fixed in 1.6.1
- 0.0.x0.0.0 – 0.0.125Fixed in 0.0.126
Moderate
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect MockGHSA-82fw-gwwq-j7x9 · 8 Sep 2026
- 4.x4.0.0 – 4.1.10Fixed in 4.1.11
- 3.x3.0.0 – 3.2.7No fix on 3.x · move to 4.1.11
- 2.x2.1.0 – 2.1.9No fix on 2.x · move to 4.1.11

What npm and deps.dev say about the latest release. Signals, not a verdict.

Licence
MIT
Provenance
Present, built from github.com/vitest-dev/vitest
Says where the release was built and from which commit. It does not say the code is safe.
Published by
GitHub Actions
Maintainers on npm
ariperkkio, antfu, hiogawa, oreanno, yyx990803
Size
2.8 MB unpacked, 104 files
GitHub stars
17,214 on vitest-dev/vitest
Last release
5.0.4, 12 October 2026
OpenSSF Scorecard
No Scorecard for this repository

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.