Vitest - Path Traversal (CVE-2025-24963)

CVE-2025-24963 is a path traversal vulnerability in the Vitest testing framework, specifically affecting the __screenshot-error handler in browser mode when the server is exposed to the network. This flaw allows remote attackers to access arbitrary files on the file system, potentially leaking sensitive information if the server is misconfigured. Users are strongly advised to upgrade to versions 2.1.9 or 3.0.4 to mitigate the risk of unauthorized file disclosure.

CrowdSec has been tracking this vulnerability and its exploits since 15th of May 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-24963 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2025-24963. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit the /__screenshot-error endpoint by supplying a file parameter to read arbitrary files from the server's filesystem, targeting Vitest browser mode servers exposed to the network.