CVE-2026-112949 Vitest: Code injection via unauthenticated manual mock registration
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-112949?
CVE-2026-112949 is a medium-severity vulnerability in @vitest mocker, published on 20 Oct 2026.
Official description
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.
Which versions are affected by CVE-2026-112949?
4 open source packages ship an affected version, including @vitest/mocker.
| Package | Affected | Fixed in |
|---|---|---|
@vitest/mocker npm | From 2.1.0-beta.7 | 4.1.12 |
@vitest/mocker npm | From 2.1.0-beta.7 | 4.1.12 |
@vitest/mocker npm | From 5.0.0-beta.1 | 5.0.3 |
@vitest/mocker npm | From 5.0.0-beta.1 | 5.0.3 |
How do I fix CVE-2026-112949?
Upgrade @vitest/mocker to a fixed version for your release line: 4.1.12 or 5.0.3.
Is CVE-2026-112949 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-112949 exists.
Sources
Also known as CLSA-2026-1793114894, CLSA-2026-1793115217, GHSA-qxg6-89mg-rqv8.