Vulnerability intelligence

CVE-2026-47428

Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.

CVSS Score

—

Critical

EPSS — Exploit Probability

0.4%

Riskier than 29% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

unknown

Check vendor advisories

NVD entry

1 article across 1 outlet · first covered Jun 5, 2026 · latest Jun 5, 2026

Coverage timeline

Critical Vitest flaws expose dev setups to remote code execution
securityonline.info · Jun 5, 2026