Vitest Browser Mode Cross-Site Scripting Vulnerability Allowing Token Theft and Remote Code Execution

A critical cross-site scripting vulnerability has been identified in Vitest, a testing framework powered by Vite. This issue affects Vitest versions 4.0.17 prior to 4.1.6 and 5.0.0-beta.3. The vulnerability arises in Vitest Browser Mode, where the 'otelCarrier' query parameter is unsanitized and directly injected into an inline module script. This flaw allows a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin, potentially leading to the theft of the 'VITEST_API_TOKEN', which is used for authenticated API calls. Exploitation of this vulnerability can be chained with server-side code execution by writing a payload into 'vite.config.ts', which is then executed in Node when the config is reloaded.

Impact

Exploitation of this vulnerability allows for cross-site scripting in the Vitest browser runner origin, with a confirmed proof of concept demonstrating the execution of an alert. This injection point can also be used to recover the 'VITEST_API_TOKEN' and execute a payload in the local 'vite.config.ts', leading to remote code execution when Vitest/Vite reloads the config.

Reproduction

To reproduce this vulnerability, start Vitest in browser mode with the official Lit example. Once the Vitest browser server is running, open a crafted URL that includes the 'otelCarrier' query parameter with a JavaScript payload, such as an alert. This will trigger the alert, confirming the cross-site scripting vulnerability. The same injection point can be used to recover the 'VITEST_API_TOKEN' and execute a payload in the 'vite.config.ts' file, achieving remote code execution.

Remediation

Users can upgrade to Vitest versions 4.1.6 or 5.0.0-beta.3 to address this vulnerability.