Vitest Browser Mode Arbitrary JavaScript Execution

Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) flaw in Vitest's browser mode. It occurs because the otelCarrier query parameter is inserted directly into an inline module script without sanitization. This allows attackers to craft malicious URLs that execute arbitrary JavaScript in the Vitest server origin when opened by a victim.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to Vitest's browser mode and can be detected by checking the Vitest version in use. If your system runs Vitest versions >=4.0.17 and <4.1.6 or >=5.0.0-beta.0 and <5.0.0-beta.3, it is vulnerable. No direct network or system commands are provided in the context to detect exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker can recover the VITEST_API_TOKEN, which authenticates WebSocket API calls. In local setups, this may lead to remote code execution by modifying the vite.config.ts file through authenticated API calls, causing injected payloads to execute during Vitest reloads.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's confidentiality requirements and HIPAA's security rules for protected health information. The potential for remote code execution further exacerbates compliance risks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Vitest to version 4.1.6 or later, or 5.0.0-beta.3 or later. Avoid using vulnerable versions in browser mode. Review server logs for suspicious URLs containing the otelCarrier parameter if you suspect prior exploitation.

Useful 0 Not Useful 0