GHSA-8gvc-j273-4wm5

Source

https://github.com/advisories/GHSA-8gvc-j273-4wm5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-8gvc-j273-4wm5/GHSA-8gvc-j273-4wm5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8gvc-j273-4wm5

Aliases

CVE-2025-24963

Published

2025-02-04T16:51:08Z

Modified

2025-02-04T22:03:47Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Vitest browser mode serves arbitrary files

Details

Summary

__screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get the content of arbitrary files.

Details

This __screenshot-error handler on the browser mode HTTP server responds any file on the file system. https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130

This code was added by https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f.

PoC

Create a directory and change the current directory to that directory
Run npx vitest init browser
Run npm run test:browser
Run curl http://localhost:63315/__screenshot-error?file=/path/to/any/file

Impact

Users explicitly exposing the browser mode server to the network by browser.api.host: true may get any files exposed.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-02-04T16:51:08Z",
    "nvd_published_at":  "2025-02-04T20:15:50Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / @vitest/browser

Package

Name: @vitest/browser; View open source insights on deps.dev
Purl: pkg:npm/%40vitest/browser

Affected ranges

Type: SEMVER
Events: Introduced

2.0.4

Fixed

2.1.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-8gvc-j273-4wm5/GHSA-8gvc-j273-4wm5.json"

npm / @vitest/browser

Package

Name: @vitest/browser; View open source insights on deps.dev
Purl: pkg:npm/%40vitest/browser

Affected ranges

Type: SEMVER
Events: Introduced

3.0.0

Fixed

3.0.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-8gvc-j273-4wm5/GHSA-8gvc-j273-4wm5.json"