Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis identified a critical XSS vulnerability in Vitest's browser mode. The root cause is the lack of input sanitization for the otelCarrier query parameter, which is used to construct a dynamic script. The vulnerable function is the anonymous middleware handler within ServerOrchestrator.onServerCreated in packages/browser/src/node/serverOrchestrator.ts. This function directly injects the user-provided otelCarrier value into the HTML response, allowing for arbitrary script execution. The patch mitigates this by no longer injecting the value directly into the script content, but rather passing it through a data attribute after escaping, which is then safely parsed on the client side. This prevents the XSS and the subsequent potential for RCE.
ServerOrchestrator.onServerCreatedpackages/browser/src/node/serverOrchestrator.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @vitest/browser | npm | >= 4.0.17, < 4.1.6 | 4.1.6 |
| @vitest/browser | npm | >= 5.0.0-beta.0, < 5.0.0-beta.3 | 5.0.0-beta.3 |