CVE-2026-112949 | vitest-dev Vitest up to 4.1.11/5.0.2 mocker createManualModuleSource url escape output

October 20, 2026 Yanac

A vulnerability, which was classified as critical, has been found in vitest-dev Vitest up to 4.1.11/5.0.2. This vulnerability affects the function createManualModuleSource of the component mocker. The manipulation of the argument url leads to escaping of output.

This vulnerability is listed as CVE-2026-112949. The attack may be initiated remotely. There is no available exploit.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More