npm - OSV

GHSA-px85-f4q5-jh77

npm/@storybook/addon-mcp
npm/@storybook/addon-vitest
npm/@storybook/core
npm/@storybook/core-server
npm/@storybook/experimental-addon-test
... 1 more

Storybook dev server vulnerable to code injection from the local network 22 Oct

Fix available
Severity - 8.7 (High)

GHSA-p458-7748-mcp3

npm/@vitest/browser
npm/@vitest/ui
npm/vite-plus

Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys,... 21 Oct

Fix available
Severity - 6.5 (Medium)

GHSA-qxg6-89mg-rqv8

npm/@vitest/mocker

Vitest: Code injection via unauthenticated manual mock registration 21 Oct

Fix available
Severity - 4.7 (Medium)

GHSA-xp26-3454-mjgp

npm/@vitest/mocker

Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect... 21 Oct

Fix available
Severity - 5.9 (Medium)

GHSA-f2ph-cmg5-wxc8

npm/@storybook/addon-mcp
npm/@storybook/addon-vitest
npm/@storybook/core
npm/@storybook/core-server
npm/@storybook/experimental-addon-test
... 1 more

Storybook: Missing origin validation in Storybook preview allows code injection... 21 Oct

Fix available
Severity - 9.4 (Critical)

GHSA-82fw-gwwq-j7x9

npm/@vitest/mocker
npm/vitest

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock 08 Sep

Fix available
Severity - 5.9 (Medium)

MAL-2026-15870

npm/vitest-cli-dev

Malicious code in vitest-cli-dev (npm) 04 Sep

No fix available

MAL-2026-15818

npm/vitest-cli-pro

Malicious code in vitest-cli-pro (npm) 02 Sep

No fix available

MAL-2026-15563

npm/vitest-chalk-pro

Malicious code in vitest-chalk-pro (npm) 29 Aug

No fix available

MAL-2026-13405

npm/vitest-preview-pro-all

Malicious code in vitest-preview-pro-all (npm) 06 Aug

No fix available

MAL-2026-12370

npm/eslint-plugin-vitest-ts

Malicious code in eslint-plugin-vitest-ts (npm) 05 Aug

No fix available

MAL-2026-12004

npm/vitest-preview-pro

Malicious code in vitest-preview-pro (npm) 04 Aug

No fix available

MAL-2026-11030

npm/vitest-axios

Malicious code in vitest-axios (npm) 23 Jul

No fix available

GHSA-p63j-vcc4-9vmv

npm/@vitest/browser

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate 21 Jul

Fix available
Severity - 9.4 (Critical)

MAL-2026-10990

npm/ts-vitest

Malicious code in ts-vitest (npm) 21 Jul

No fix available

MAL-2026-6710

npm/vitest-agent

Malicious code in vitest-agent (npm) 01 Jul

No fix available

Vulnerabilities