CWE-306

{
  "affected": [],
  "aliases": [
    "CVE-2023-22441"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-10T06:15:11Z",
    "severity": "HIGH"
  },
  "details": "Missing authentication for critical function exists in Seiko Solutions SkyBridge series, which may allow a remote attacker to obtain or alter the setting information of the product or execute some critical functions without authentication, e.g., rebooting the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier",
  "id": "GHSA-qwcg-gr98-8m32",
  "modified": "2024-04-04T03:58:23Z",
  "published": "2023-05-10T06:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22441"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN40604023"
    },
    {
      "type": "WEB",
      "url": "https://www.seiko-sol.co.jp/archives/73969"
    },
    {
      "type": "WEB",
      "url": "https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a100"
    },
    {
      "type": "WEB",
      "url": "https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a130"
    },
    {
      "type": "WEB",
      "url": "https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a200"
    },
    {
      "type": "WEB",
      "url": "https://www.seiko-sol.co.jp/products/skyspider/skyspider_download/mb-r210"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-19092"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-04-02T20:15:00Z",
    "severity": "LOW"
  },
  "details": "ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code (MAC). Alterations to Viewstate might thus not be noticed.",
  "id": "GHSA-qwpj-549m-7v5q",
  "modified": "2023-05-16T21:30:17Z",
  "published": "2022-05-24T17:13:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19092"
    },
    {
      "type": "WEB",
      "url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-49604"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-288",
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-20T08:15:04Z",
    "severity": "CRITICAL"
  },
  "details": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Najeeb Ahmad Simple User Registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through 5.5.",
  "id": "GHSA-qwpx-5prv-xmxx",
  "modified": "2026-04-01T18:32:06Z",
  "published": "2024-10-20T09:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49604"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/wp-registration/vulnerability/wordpress-simple-user-registration-plugin-5-5-account-takeover-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/wp-registration/wordpress-simple-user-registration-plugin-5-5-account-takeover-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-11061"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-08-29T01:15:00Z",
    "severity": "HIGH"
  },
  "details": "A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://[target]/smarthome/devicecontrol without any authentication.",
  "id": "GHSA-qwvg-w866-x6c3",
  "modified": "2024-04-04T01:50:32Z",
  "published": "2022-05-24T16:55:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11061"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tim124058/ASUS-SmartHome-Exploit"
    },
    {
      "type": "WEB",
      "url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906003"
    },
    {
      "type": "WEB",
      "url": "http://surl.twcert.org.tw/5df6x"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-38147"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-29T08:15:00Z",
    "severity": "HIGH"
  },
  "details": "Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/Domain_Credential_Report_Excel, processexecution/DownloadExcelFile/User_Report_Excel, processexecution/DownloadExcelFile/Process_Report_Excel, processexecution/DownloadExcelFile/Infrastructure_Report_Excel, or processexecution/DownloadExcelFile/Resolver_Report_Excel.",
  "id": "GHSA-qx47-qw9g-58j7",
  "modified": "2021-12-01T00:00:45Z",
  "published": "2021-11-30T00:00:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38147"
    },
    {
      "type": "WEB",
      "url": "https://www.wipro.com/holmes"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/165039/Wipro-Holmes-Orchestrator-20.4.1-Report-Disclosure.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-27495"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-05T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "On all versions 1.3.x (fixed in 1.4.0) NGINX Service Mesh control plane endpoints are exposed to the cluster overlay network. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated",
  "id": "GHSA-qx4q-jhfj-788f",
  "modified": "2022-05-14T00:03:33Z",
  "published": "2022-05-06T00:00:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27495"
    },
    {
      "type": "WEB",
      "url": "https://support.f5.com/csp/article/K94093538"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ethyca-fides"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.75.0"
            },
            {
              "fixed": "2.83.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42303"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-288",
      "CWE-306",
      "CWE-841"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T21:11:37Z",
    "nvd_published_at": "2026-05-12T18:17:24Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nFides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject\u0027s records across every integration configured in the affected deployment.\n\nA related lower-severity denial-of-service issue, in which an unauthenticated attacker could prevent a legitimate data subject from completing their own privacy requests, is also patched in the fix for this vulnerability.\n\n### Am I affected?\n\nThis vulnerability only affects deployments that use Fides\u0027s privacy request (data subject request) features, also known collectively as \"Lethe\". Deployments that do not submit, process, or manage privacy requests through Fides are not affected.\n\nWithin deployments that do use privacy request features, your deployment is affected if both of the following settings are effectively set to `true`:\n\n- `subject_identity_verification_required`\n- `privacy_request_duplicate_detection.enabled`\n\nBoth settings default to `false`.\n\nEach setting can be configured in multiple places. If the same setting is configured in more than one place, Fides resolves conflicts in the following precedence order, highest priority first:\n\n1. **Admin UI / configuration API** - stored in the application database and applied at runtime\n2. **Environment variables** - read at webserver startup\n3. **`fides.toml`** - read at webserver startup\n4. **Default value** - used if none of the above set the value\n\nTo determine whether your deployment is affected, check each setting in every location that applies to your configuration management.\n\n**`subject_identity_verification_required`**\n\n- `fides.toml`: under the `[execution]` section as `subject_identity_verification_required = true`\n- Environment variable: `FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED=true`\n- No Admin UI control - this setting is not exposed through the Admin UI and cannot be set via the configuration API\n\n**`privacy_request_duplicate_detection.enabled`**\n\n- `fides.toml`: under the `[privacy_request_duplicate_detection]` section as `enabled = true`\n- Environment variable: `FIDES__PRIVACY_REQUEST_DUPLICATE_DETECTION__ENABLED=true`\n- Admin UI: **Settings \u2192 Privacy requests \u2192 Duplicate detection**, via the \"Enable duplicate detection\" toggle. The toggle reflects only values set through the Admin UI or configuration API. A value set via `fides.toml` or environment variable will not appear here.\n\n\u003cfigure\u003e\n\u003cimg width=\"1392\" height=\"940\" alt=\"GHSA - Duplicate Detection Enabled\" src=\"https://github.com/user-attachments/assets/e384f273-ce68-403c-adb2-93536eca5f3a\" /\u003e\n\u003cfigcaption\u003e\n\u003cem\u003e\nThe \"Enable duplicate detection\" toggle when it\u0027s enabled, under Settings \u2192 Privacy requests in the Admin UI.\n\u003c/em\u003e\n\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n### Details\n\nWhen duplicate detection classifies a privacy request as a duplicate before its identity has been verified, the administrative interface presents that request with Approve, Deny, and Delete options. An administrator performing routine duplicate request triage may approve such a request without realising the identity was never verified. The request is then processed as if verification had succeeded.\n\nAn attacker exploits this by submitting two privacy requests using a target\u0027s email address, never completing the OTP verification. The second request is classified as a duplicate and becomes approvable through the administrative interface.\n\nThe fix for this vulnerability also patches a lower-severity issue, present in versions `2.82.0` through `2.83.1`, in which a legitimate data subject could not complete identity verification on a privacy request that had been classified as a duplicate, allowing an unauthenticated attacker to block that data subject from exercising their privacy rights through the affected deployment.\n\n### Impact\n\nAn unauthenticated attacker who knows a target\u0027s email address and can reach the public Privacy Center can cause an erasure privacy request to be approved by an administrator and processed without identity verification. The result is unauthorized deletion of the data subject\u0027s records across every integration configured in the affected deployment. Effects may be permanent and may cascade into downstream systems.\n\nAccess privacy requests are a less meaningful vector: the resulting access package is delivered to the data subject\u0027s registered email address, not to the attacker, so the attacker does not gain the data. The request still represents unauthorized processing.\n\n### Patches\n\nThe vulnerabilities have been patched in Fides OSS version `2.83.2`. Users are advised to upgrade to this version or later to secure their systems against these threats.\n\nFides Enterprise (fidesplus) version `2.83.2` contains the same patch.\n\n### Workarounds\n\nDisable duplicate detection by setting `privacy_request_duplicate_detection.enabled` to `false`. This can be changed under **Settings \u2192 Privacy Requests \u2192 Duplicate detection** in the Admin UI). This fully mitigates the vulnerability and is the recommended interim workaround for deployments that cannot immediately upgrade.\n\n\u003cfigure\u003e\n\u003cp\u003e\n\u003cimg width=\"1392\" height=\"880\" alt=\"GHSA - Disable Duplicate Detection\" src=\"https://github.com/user-attachments/assets/fc0c87a1-7e40-4698-ba9e-e1721f591310\" /\u003e\n\u003cfigcaption\u003e\n\u003cem\u003e\nThe \"Enable duplicate detection\" toggle when it\u0027s disabled, under Settings \u2192 Privacy requests in the Admin UI.\n\u003c/em\u003e\n\u003c/figcaption\u003e\n\u003cp\u003e\n\u003c/figure\u003e\n\nAdministrators of deployments that must retain duplicate detection should deny or delete, rather than approve, any privacy request whose identity has not been verified. This reduces the likelihood of exploitation but relies on administrator vigilance during each triage action.\n\n\u003cimg width=\"1392\" height=\"1044\" alt=\"GHSA - Admin Approval of Unverified Privacy Request\" src=\"https://github.com/user-attachments/assets/b2ad4940-40d3-468b-897e-8cca6ce4707e\" /\u003e\n\u003cfigcaption\u003e\n\u003cem\u003e\nAn administrator\u0027s view when approving an unverified privacy request in the Admin UI.\n\u003c/em\u003e\n\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n### Severity\n\nThis vulnerability has been assigned a severity of **MEDIUM**.\n\nThe rating reflects the fact that exploitation requires an administrator to approve the malicious request. An attacker alone cannot cause a privacy request to be processed. The administrative interface understates the verification state of a duplicate-classified request, which increases the likelihood of inadvertent approval during routine triage, but without administrator user interaction the vulnerability is not exploitable.\n\nThe related denial-of-service issue addressed in the same patch is also rated medium-severity in isolation and does not raise the overall severity of this advisory.\n\n### References\n\n- Fides OSS `2.83.2` release: https://github.com/ethyca/fides/releases/tag/2.83.2\n- Fix for the identity bypass vulnerability: [PR #7972](https://github.com/ethyca/fides/pull/7972), commit [`e7a6527`](https://github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd)\n- Fix for the related denial-of-service issue: [PR #7971](https://github.com/ethyca/fides/pull/7971), commit [`0e320b2`](https://github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37)",
  "id": "GHSA-qx5f-ghc2-7g5c",
  "modified": "2026-05-13T16:26:42Z",
  "published": "2026-05-05T21:11:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42303"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ethyca/fides/pull/7971"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ethyca/fides/pull/7972"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ethyca/fides"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ethyca/fides/releases/tag/2.83.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-40006"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-10T08:16:22Z",
    "severity": "HIGH"
  },
  "details": "Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB.\nWhen pipe_air_gap_receiver_enabled=true, the IoTDB AirGap pipe receiver\naccepts raw TCP connections on port 9780 with no authentication. The\nreadLength method reads an attacker-controlled 32-bit integer from the\nsocket and readData passes it directly to new byte[length] with no\nupper-bound check. An unauthenticated attacker can cause the JVM to attempt\nan allocation of up to 2,147,483,647 bytes per connection, exhausting heap\nmemory and crashing or severely degrading the DataNode process.\n\n\nThis issue affects Apache IoTDB: from 1.0.0 before 2.0.10.\n\nUsers are recommended to upgrade to version 2.0.10, which fixes the issue.",
  "id": "GHSA-qx9j-cv9x-384r",
  "modified": "2026-07-10T18:32:13Z",
  "published": "2026-07-10T09:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40006"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/rfpt7m9fvdrw37r3ow5omp2n914z6zqk"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/10/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-50604"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-17T05:17:01Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be established, potentially allowing access to functionality that should be restricted.",
  "id": "GHSA-qxc2-c2cj-76r5",
  "modified": "2026-09-17T06:30:33Z",
  "published": "2026-09-17T06:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50604"
    },
    {
      "type": "WEB",
      "url": "https://community.acer.com/en/kb/articles/19871"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@vitest/mocker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0-beta.7"
            },
            {
              "fixed": "4.1.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@vitest/mocker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-beta.1"
            },
            {
              "fixed": "5.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-112949"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-306",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-21T19:54:26Z",
    "nvd_published_at": "2026-10-20T16:17:05Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`@vitest/mocker`\u0027s `interceptorPlugin` accepts mock registrations on Vite\u0027s dev-server WebSocket with no authentication, and interpolates the mock\u0027s `url` into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any project module, which then runs in the developer\u0027s browser on the dev-server origin.\n\nSame handler and same unauthenticated caller as GHSA-82fw-gwwq-j7x9; that fix (`8ff9b9a9efca7c6cfd5243569440de8d7a33aec4`, PR #10972) hardened only the `redirect` branch and left the `manual` branch reaching the unescaped generator.\n\n### Patches\n\nFixed in `@vitest/mocker` 5.0.3, released on 2026-09-30 (PR #11377), and backported to 4.1.12. `createManualModuleSource` now serializes the module URL and the export names with `JSON.stringify`, so a registered mock cannot change the generated code.\n\nProjects that call `mockerPlugin()` or `interceptorPlugin()` directly need `@vitest/mocker` 4.1.12 or 5.0.3.\n\n### Details\n\n`packages/mocker/src/utils.ts:6-9` builds module source by string interpolation:\n\n```ts\nexport function createManualModuleSource(moduleUrl: string, exports: string[], globalAccessor = \u0027\"__vitest_mocker__\"\u0027): string {\n  const source = `\nconst __factoryModule__ = await globalThis[${globalAccessor}].getFactoryModule(\"${moduleUrl}\");\n`\n```\n\n`moduleUrl` lands inside a double-quoted JavaScript string with no escaping or validation.\n\n`packages/mocker/src/node/interceptorPlugin.ts:66-93` feeds it straight from the socket:\n\n```ts\nconfigureServer(server) {\n  if (options.registerWebSocketEvents === false) { return }\n  server.ws.on(\u0027vitest:interceptor:register\u0027, (event: MockedModuleSerialized) =\u003e {\n    if (event.type === \u0027manual\u0027) {\n      const module = ManualMockedModule.fromJSON(event, async () =\u003e {\n        const keys = await getFactoryExports(event.url)\n        return Object.fromEntries(keys.map(key =\u003e [key, null]))\n      })\n      registry.add(module)                       // no validation of `id` or `url`\n    }\n    else {\n      if (event.type === \u0027redirect\u0027) { /* fs allowlist check added in #10972 */ }\n```\n\n`event.id` chooses which module is hijacked; `event.url` is what gets interpolated. The `load` hook (`interceptorPlugin.ts:30-44`) then returns `createManualModuleSource(mock.url, exports, accessor)` for that id.\n\nWith `url = \u0027x\"); globalThis.ARES_INJECTED = 1; void(\"\u0027` a request for `/src/app.js` is answered with valid, executable JavaScript:\n\n```js\nconst __factoryModule__ = await globalThis[\"__vitest_mocker__\"].getFactoryModule(\"x\"); globalThis.ARES_INJECTED = 1; void(\"\");\n```\n\n`getFactoryExports` (`interceptorPlugin.ts:103-117`) also takes the export-name array from the same socket, and those names are interpolated unescaped too \u2014 but each name is emitted into `__factoryModule__[\"X\"]`, `export { __0 as \"X\" }` and `resolvedModule[\"X\"]`, and no payload tested parses in all three positions (all nine candidates were rejected by the parser). It is a hardening gap, not a second usable vector; `url` is the exploited one.\n\n**Who can reach the socket.** Vite 8 answers HTTP 400 to any HMR upgrade carrying an `Origin` header it does not own, so a cross-origin browser page cannot open it \u2014 the PoC asserts this for `https://evil.example` and `http://localhost:3000`. The reachable attacker is a non-browser WebSocket client with access to the dev server\u0027s port, the same prerequisite under which GHSA-82fw-gwwq-j7x9 was published.\n\n### PoC\n\n`poc/mocker-manual-mock-injection/` \u2014 `repro.sh` (exit 0 = vulnerable), `poc.mjs`, `expected.txt`, `env.txt`. Everything lives under a fresh `mktemp` directory deleted on exit, the dev server binds to `127.0.0.1` on an ephemeral port, no external host is contacted, and the payload is only inspected as text \u2014 the script never evaluates it.\n\nEnvironment: commit `9e1166959e14bd32298d8a0e85352431c769ec7a`, `@vitest/mocker` 5.0.0, Node v22.23.1, Vite 8.0.11, ws 8.21.3, pnpm 11.24.0, Linux x86_64.\n\n```bash\ngit clone https://github.com/vitest-dev/vitest \u0026\u0026 cd vitest\ngit checkout 9e1166959e14bd32298d8a0e85352431c769ec7a\npnpm install \u0026\u0026 pnpm build\nREPO=$(pwd) bash /path/to/poc/mocker-manual-mock-injection/repro.sh\n```\n\nRequired configuration \u2014 the public setup documented in `packages/mocker/EXPORTS.md`, which the harness reproduces (`mockerPlugin()` wires `interceptorPlugin` the same way):\n\n```ts\nimport { interceptorPlugin } from \u0027@vitest/mocker/node\u0027\nexport default defineConfig({ plugins: [interceptorPlugin()] })   // or mockerPlugin()\n```\n\nThe attack is one WebSocket message to `ws://\u003chost\u003e:\u003cport\u003e/` with subprotocol `vite-hmr`:\n\n```json\n{ \"type\": \"custom\", \"event\": \"vitest:interceptor:register\",\n  \"data\": { \"type\": \"manual\", \"raw\": \"\", \"id\": \"\u003cabs path of a served module\u003e\",\n            \"url\": \"x\\\"); globalThis.ARES_INJECTED = 1; void(\\\"\" } }\n```\n\nthen answering the server\u0027s `vitest:interceptor:resolve` with `{\"type\":\"custom\",\"event\":\"vitest:interceptor:resolved\",\"data\":{\"url\":\"\u003csame url\u003e\",\"keys\":[\"a\"]}}`. The module id can be obtained from the same socket via `vitest:mocks:resolveId` when `mockerPlugin()` is used.\n\nObserved output:\n\n```\nPASS  precondition: Vite rejects a WebSocket upgrade sent with Origin https://evil.example  result=400\nPASS  precondition: Vite rejects a WebSocket upgrade sent with Origin http://localhost:3000  result=400\nPASS  negative control: with no mock registered the real module is served\nPASS  negative control: a mock with a harmless url replaces the module but injects nothing\n--- module served for /src/app.js ---\n    const __factoryModule__ = await globalThis[\"__vitest_mocker__\"].getFactoryModule(\"x\"); globalThis.ARES_INJECTED = 1; void(\"\");\n\n    let __0 = __factoryModule__[\"a\"]\n    export { __0 as \"a\" }\n    if (__factoryModule__.__factoryPromise != null) {\n      __factoryModule__.__factoryPromise.then((resolvedModule) =\u003e {\n        __0 = resolvedModule[\"a\"];\n      })\n    }\nPASS  attacker statement is present in the module the dev server serves\nPASS  the real module body was replaced\nPASS  the injected module parses as JavaScript (Vite import analysis accepted it)\n\nRESULT: VULNERABLE\n```\n\n* **Positive control** \u2014 with no mock registered, `/src/app.js` is served with its real body, so the harness demonstrably works.\n* **Negative control** \u2014 the same registration with a harmless `url` replaces the module but injects nothing, attributing the injection to the payload rather than to mock registration.\n* **Precondition controls** \u2014 the two `Origin` probes record the boundary honestly.\n* Vite\u0027s import analysis rejects malformed output (an earlier deliberately-broken payload failed with \"content contains invalid JS syntax\"), so acceptance proves the injected module is valid, executable JavaScript.\n\nReproduced three times from a clean `mktemp` fixture, exit 0 each time.\n\n### Impact\n\nCode injection (CWE-94) by an unauthenticated client. The attacker picks any module id the project serves and replaces its body with arbitrary JavaScript, which executes in the developer\u0027s browser on the dev-server origin: reading source through the dev server, reading that origin\u0027s storage and cookies, driving further same-origin requests, and persisting across reloads while the mock stays registered. Nothing is written to disk, so it leaves no trace in the repository. Impacts developers who use the public `mockerPlugin()`/`interceptorPlugin()` API documented in `packages/mocker/EXPORTS.md`. Node runs do not register these handlers. Development-only \u2014 `configureServer` does not run for `vite build` or `vite preview`.\n\n### Credits\n\n- Thai Son Dinh from VinSOC Labs (R\u0026D)\n\nDisclosure per CONTRIBUTING.md: the analysis and proof of concept were assisted by Claude (Claude Code). The findings were reviewed by the reporter above, who is submitting this report.",
  "id": "GHSA-qxg6-89mg-rqv8",
  "modified": "2026-10-21T19:54:26Z",
  "published": "2026-10-21T19:54:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112949"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vitest-dev/vitest"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.12"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vitest: Code injection via unauthenticated manual mock registration"
}