Security readout for executives and security teams
Plain-English summary
A Vitest Browser Mode page could turn part of a URL into script without sanitizing it. If a user opened a crafted runner URL, JavaScript could run in the Vitest server origin and expose the Vitest API token. This is most urgent where test servers are reachable by untrusted users or networks.
Executive priority
Prioritize remediation for developer workstations, CI systems, and shared test infrastructure using Vitest Browser Mode. This is critical because token theft could enable authenticated actions against the Vitest API, but the provided evidence requires user interaction and does not confirm active exploitation.
Technical view
CVE-2026-47428 is a CWE-79 issue in Vitest Browser Mode. Affected /__vitest_test__/ handling inserted the otelCarrier query parameter into an inline module script. The advisory states this could execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls.
Likely exposure
Exposure is likely limited to environments using Vitest Browser Mode on affected versions: >=4.0.17 and <4.1.6, or >=5.0.0-beta.0 and <5.0.0-beta.3. Risk rises if the Vitest server is network-accessible or developers can be induced to open runner URLs.
Exploitation context
The CVSS vector indicates network reachability, low complexity, no privileges, and required user interaction. The source bundle does not show CISA KEV listing or confirmed active exploitation. Treat exploitation as plausible but not confirmed from the provided evidence.
Researcher notes
Focus review on Browser Mode request handling for /__vitest_test__/ and treatment of otelCarrier inside inline module script generation. The supplied commits and pull requests are the best references for the exact fix. Avoid assuming impact outside Vitest Browser Mode without additional evidence.
Mitigation direction
- Upgrade Vitest to 4.1.6 or later on the 4.x line.
- For beta deployments, upgrade to 5.0.0-beta.3 or later.
- Restrict Vitest Browser Mode servers to trusted local or internal access.
- Avoid sharing or opening untrusted Vitest browser-runner URLs.
- Check vendor advisory and release notes before deployment.
Validation and detection
- Inventory package manifests and lockfiles for affected Vitest version ranges.
- Identify projects using Vitest Browser Mode or browser-runner URLs.
- Confirm Vitest servers are not exposed to untrusted networks.
- Review logs for unexpected /__vitest_test__/ requests containing otelCarrier.
- Verify upgraded environments resolve to fixed Vitest versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-47428 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H2.86GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.6CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cpppCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/vitest-dev/vitest/pull/10283CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/vitest-dev/vitest/pull/10285CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafaCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/vitest-dev/vitest/releases/tag/v4.1.6CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.