CVE-2025-24964
Published: 04 February 2025
Summary
CVE-2025-24964 is a critical-severity Missing Origin Validation in WebSockets (CWE-1385) vulnerability in Vitest.Dev Vitest. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 16.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-23 (Session Authenticity).
Deeper analysis
Vitest, a Vite-powered testing framework, contains a Cross-site WebSocket hijacking vulnerability in its API server component when the api option is enabled, as occurs by default with Vitest UI. The server, started to support saveTestFile and rerun operations over WebSocket, omits Origin header validation and any authorization checks, allowing unauthenticated remote interaction with the exposed endpoints.
An attacker who can lure a victim into visiting a malicious website while the Vitest API server is active can hijack the WebSocket connection. This grants the ability to invoke saveTestFile to inject arbitrary code into a test file and then call rerun to execute that file, resulting in remote code execution on the host running Vitest.
The GitHub Security Advisory and linked source references indicate the issue is resolved in Vitest versions 1.6.1, 2.1.9, and 3.0.5, with users directed to upgrade; no workarounds are documented.
EPSS for the CVE rose from a low of 0.0194 to a peak of 0.0463, indicating that exploitation interest emerged after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-0225
Vulnerability details
Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest…
more
UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables client-side RCE via CSWSH on local WebSocket server when user visits malicious site; directly maps to exploitation for client execution and malicious link delivery requiring user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring identification, reporting, and patching of the flaw in Vitest's WebSocket server lacking Origin validation and authorization.
Prevents Cross-site WebSocket hijacking attacks by enforcing authenticity mechanisms such as Origin header checks on WebSocket communications sessions.
Enforces access control and authorization on exposed WebSocket APIs like saveTestFile and rerun to block unauthorized code injection and execution.