Vitest, a JavaScript testing framework built on Vite, served its /__vitest_test__/ endpoint in Browser Mode. From version 4.0.17 until 4.1.6 and 5.0.0‑beta.3, the otelCarrier query parameter was inserted directly into an inline module script without sanitization. This allowed a crafted browser‑runner URL to inject unsanitized JavaScript that executed with the privileges of the Vitest server origin, enabling an attacker to extract the VITEST_API_TOKEN and issue authenticated API calls. The issue is fixed in versions 4.1.6 and 5.0.0‑beta.3.

The vulnerability affects Vitest Browser Mode in all releases from 4.0.17 through 4.1.5 inclusive, and in 5.0.0‑beta.1 through 5.0.0‑beta.2 inclusive. Versions 4.1.6 and 5.0.0‑beta.3 contain the fix. All other newer releases are not affected.

The CVSS score of 9.6 indicates a severe risk, but the EPSS of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to craft a browser‑based URL targeting the Vitest server's /__vitest_test__/ endpoint; the injected JavaScript would then execute with the privileges of the Vitest process, enabling token theft and unauthorized API usage. No special privileges or local access are required. The vulnerability has been fixed in Vitest releases 4.1.6 and 5.0.0‑beta‑3; all later versions are not affected.