unstale

npm / @vitest/web-worker

@vitest/web-worker

What changed in @vitest/web-worker 4 to 5, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-27.

7 security

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

@vitest/web-worker 53 changes

Security 3

  • Vitest: Servers misapply server.fs.deny, serving .env, private keys, .git, and the API token file

    5.0.5security advisory

  • Vitest: Code injection via unauthenticated manual mock registration

    4.1.12, 5.0.3security advisory

  • Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

    4.1.12, 5.0.3security advisory

@vitest/web-worker 44 changes

Security 4

  • Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

    4.1.11security advisory

  • @vitest/browser: Browser Mode provider commands bypass the file-access permission gate

    3.2.7, 4.1.10security advisory

  • Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

    3.2.5, 4.1.8security advisory

  • Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

    4.1.6security advisory