Critical · published February 4, 2025
🚨 When you enable the `api` option in Vitest, you’re opening the door to a potentially catastrophic exploit! 🔥 Think of this vulnerability like a restaurant that leaves its back door wide open during service. Anyone can stroll in and change the menu by submitting new dishes, leading to chaos in the kitchen! An attacker can inject arbitrary code into your test files and execute it by manipulating your WebSocket connection. This could lead to a complete takeover of your testing environment, compromising the integrity of your applications and potentially exposing sensitive data. It’s absolutely devastating!
Think of this vulnerability like a restaurant that leaves its back door wide open during service. Anyone can stroll in and change the menu by submitting new dishes, leading to chaos in the kitchen! This vulnerability arises from a lack of Origin header validation and authorization in the Vitest WebSocket server, allowing Cross-site WebSocket hijacking (CSWSH) attacks to occur freely, permitting arbitrary remote code execution via the `saveTestFile` and `rerun` APIs.
An attacker can inject arbitrary code into your test files and execute it by manipulating your WebSocket connection. This could lead to a complete takeover of your testing environment, compromising the integrity of your applications and potentially exposing sensitive data. It’s absolutely devastating! Immediately upgrade Vitest to versions 1.6.1, 2.1.9, or 3.0.5 to patch this vulnerability. Ensure to audit your configurations, especially if you’re using the `api` option, to prevent any malicious access in the future. Don’t wait—secure your testing environment now! You've got this! By following these steps, you can swiftly lock down your Vitest setup and keep your projects safe! 🛡️