Skip to content

CyberSIXT Search

vitest-dev product

vitest

← All vitest-dev products

No vitest CVE is in the CISA KEV catalogue.

Tracked since 5 Jun · latest article Tue 16 Jun · RSS

Open KEV deadlines: 0; None open
Added to KEV · 90 days: 0; of 0 all time
High exploit odds · current: 0; high · not in KEV
Articles · 7 days: 0; usual rate

Exploited, by due date

No vitest CVE is in the CISA KEV catalogue.

Coverage

2 articles · all timeFull timeline →

Two articles so far, 5 Jun to 16 Jun.

Fri 5 Jun · first reportCritical Vitest flaws expose dev setups to remote code executionSecurityOnline
Tue 16 JunVitest RCE Vulnerability (CVSS 9.8): Public PoC Disclosed for Testing Tool With 57M Weekly Downloads (CVE-2026-53633)SecurityOnline

See the full timeline

16 JunVitest RCE Vulnerability (CVSS 9.8): Public PoC Disclosed for Testing Tool With 57M Weekly Downloads (CVE-2026-53633)SecurityOnline
5 JunCritical Vitest flaws expose dev setups to remote code executionSecurityOnline

All CVEs in coverage

3

CVE-2026-53633Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCECVSS9.8Critical–Not in KEV0.9%EPSS1article

CVE-2026-47429Vitest: Arbitrary file can be read and executed when Vitest UI server is listeningCVSS9.8Critical–Not in KEV0.9%EPSS1article

CVE-2026-47428Vitest browser mode serves unsanitized otelCarrier query parameter as inline scriptCVSS9.6Critical–Not in KEV0.6%EPSS1article

How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.