# CVE-2025-24963: Vitest - Path Traversal

> Live exploitation tracking for CVE-2025-24963 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-24963

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.9
- **Public exploit available:** Yes
- **Affected products:** Vitest-Dev Vitest
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** nodejs, web_application

## Description

Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

## CrowdSec analysis

[CVE-2025-24963](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-24963) is a path traversal vulnerability in the Vitest testing framework, specifically affecting the `__screenshot-error` handler in browser mode when the server is exposed to the network. This flaw allows remote attackers to access arbitrary files on the file system, potentially leaking sensitive information if the server is misconfigured. Users are strongly advised to upgrade to versions 2.1.9 or 3.0.4 to mitigate the risk of unauthorized file disclosure.

CrowdSec has been tracking this vulnerability and its exploits since 15th of May 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-24963 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2025-24963. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit the `/__screenshot-error` endpoint by supplying a `file` parameter to read arbitrary files from the server's filesystem, targeting Vitest browser mode servers exposed to the network.

## Timeline

- 2025-02-04: CVE Published. CVE-2025-24963 is published to NVD.
- 2026-05-15: Rule Released. CrowdSec releases a rule to detect CVE-2025-24963 exploitation attempts against the CrowdSec Network.
- 2026-05-22: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-24963 for the first time.

## References

- https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130
- https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5
- https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24963.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-24963) follows observed exploitation activity for CVE-2025-24963. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.