Vulnerability Intelligence Report
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
CVE-2026-47428
Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.
Cross-Site Scripting (XSS)
No Active Exploit Signals
CVSS Base Score
9.6
CRITICAL
Exploitability:2.9
Impact Score:6.1
EPSS Probability:0.37%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-79 ↗CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| vitest-dev | vitest | >= 4.0.17, < 4.1.6 (affected), >= 5.0.0-beta.0, < 5.0.0-beta.3 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | GitHub, Inc. · Vendor · USA |
| Reserved | 2026-05-19T19:37:43 |
| Published | 2026-07-14T19:30:19 |
| Last Updated | 2026-07-15T13:20:14 |
Community Chatter & Buzz