CVE-2025-24963
Published: 04 February 2025
Summary
CVE-2025-24963 is a medium-severity Path Traversal (CWE-22) vulnerability in Vitest.Dev Vitest. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Vitest, a testing framework powered by Vite, contains a path traversal vulnerability (CWE-22) in the browser mode HTTP server. The `__screenshot-error` handler, introduced in commit 2d62051, responds with the contents of arbitrary files on the filesystem when the server is explicitly exposed via the `browser.api.host: true` configuration option.
An unauthenticated remote attacker can send crafted requests to this handler over the network to read sensitive files. The attack requires no user interaction or privileges and carries a CVSS 3.1 score of 5.9, reflecting high attack complexity but full confidentiality impact.
The official GitHub advisory GHSA-8gvc-j273-4wm5 states that the flaw has been resolved in Vitest 2.1.9 and 3.0.4, and that no workarounds exist. The associated EPSS score has remained flat at 0.2364 with no material rise since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-0224
Vulnerability details
Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can…
more
send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in exposed browser mode HTTP server enables remote exploitation of public-facing application (T1190) to read arbitrary local files (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the path traversal vulnerability by requiring timely patching to Vitest versions 2.1.9 or 3.0.4 as specified in the advisory.
Prevents exploitation of the path traversal in the __screenshot-error handler by enforcing validation of file path inputs to block arbitrary file access.
Limits exposure of the vulnerable browser mode HTTP server by restricting unnecessary network exposure features like browser.api.host: true to essential functionality only.