How severe is CVE-2025-24964?

CVE-2025-24964 has a CVSS 3.x base score of 9.6, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-24964 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (48th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-24964?

CVE-2025-24964 affects Vitest.dev Vitest. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-24964?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-24964 have an EU (EUVD) identifier?

Yes. CVE-2025-24964 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-0225.

When was CVE-2025-24964 published?

CVE-2025-24964 was published on 2025-02-04 and last updated on 2026-06-17.

CVE-2025-24964

CVE-2025-24964 is a critical-severity vulnerability in Vitest.dev Vitest with a CVSS 3.x base score of 9.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1385.

Key facts

Severity: Critical (CVSS 3.x base score 9.6)
EPSS exploit prediction: 1% (48th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-0225
Weakness: CWE-1385
Affected product: Vitest.dev Vitest
Published: 2025-02-04
Last modified: 2026-06-17

Description

Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Frequently asked questions

What is CVE-2025-24964?: Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
How severe is CVE-2025-24964?: CVE-2025-24964 has a CVSS 3.x base score of 9.6, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-24964 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (48th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-24964?: CVE-2025-24964 affects Vitest.dev Vitest. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-24964?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-24964 have an EU (EUVD) identifier?: Yes. CVE-2025-24964 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-0225.
When was CVE-2025-24964 published?: CVE-2025-24964 was published on 2025-02-04 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:node.js:*:*

More vulnerabilities in Vitest.dev Vitest

CVE-2025-24963 — Medium (CVSS 5.9): Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that…

All CVEs affecting Vitest.dev Vitest →

Other CWE-1385 vulnerabilities

CVE-2024-23168 — Critical (CVSS 9.8): Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the…
CVE-2024-48849 — Critical (CVSS 9.4): Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent…
CVE-2025-52882 — High (CVSS 8.8): Claude Code is an agentic coding tool. Claude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and…
CVE-2026-34403 — High (CVSS 8.1): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui…
CVE-2025-54289 — High (CVSS 8.1): Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read…
CVE-2026-35589 — High (CVSS 8.0): nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH)…

Browse all CWE-1385 vulnerabilities →