CVE-2025-24964
Vitest.Dev Vitest ≤ 0.0.125
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HSummary
CVE-2025-24964 is a critical-severity Missing Origin Validation in WebSockets (CWE-1385) vulnerability in Vitest.Dev Vitest. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Vitest, a Vite-powered testing framework, contains a Cross-site WebSocket hijacking vulnerability in its API server component when the api option is enabled, as occurs by default with Vitest UI. The server, started to support saveTestFile and rerun operations over WebSocket, omits Origin header validation and any authorization checks, allowing unauthenticated remote interaction with the exposed endpoints.
An attacker who can lure a victim into visiting a malicious website while the Vitest API server is active can hijack the WebSocket connection. This grants the ability to invoke saveTestFile to inject arbitrary code into a test file and then call rerun to execute that file, resulting in remote code execution on the host running Vitest.
The GitHub Security Advisory and linked source references indicate the issue is resolved in Vitest versions 1.6.1, 2.1.9, and 3.0.5, with users directed to upgrade; no workarounds are documented.
EPSS for the CVE rose from a low of 0.0194 to a peak of 0.0463, indicating that exploitation interest emerged after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-0225
Vulnerability Data
Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest…
more
UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V4.4.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations on logical access, which can include origin checks before accepting WebSocket connections.
Enforces information flow policies that can require validation of communication origins at system boundaries.
Protects authenticity of communications sessions, which origin validation helps ensure for WebSocket handshakes.
Monitors and controls communications at external interfaces, directly supporting origin validation for inbound WebSocket traffic.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require origin validation for WebSocket endpoints.
Origin validation is a required step when authenticating WebSocket connection requests.
Enforcing authorization policy on incoming connections can require origin checks.
Network-level controls that block unauthorized logical access can mitigate missing origin checks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing origin validation in WebSocket implementations.
Network security controls can enforce origin validation and restrict WebSocket connections to trusted sources.
Secure configuration of network services can include origin checks for WebSocket endpoints.
Application security requirements can mandate origin validation for WebSocket communications.
Secure architecture principles can require proper origin validation mechanisms in WebSocket implementations.
Secure coding standards can explicitly require origin validation for WebSocket connections.