Is CVE-2025-24964 in the CISA KEV catalog?

No. CVE-2025-24964 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2025-24964?

CVE-2025-24964 has a CVSS v3 base score of 9.6 (CRITICAL).

What is the EPSS score for CVE-2025-24964?

CVE-2025-24964 has an EPSS score of 0.67% (48th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2025-24964?

Upgrade vitest to 3.0.5 or later.

CVE & CISA-KEV Catalog

CVE-2025-24964

CRITICAL

9.6

CVSS v3

NVD

Description

Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CWE-1385

How to fix

Remediation Available

vitestNVD

Affected:>= 3.0.0, < 3.0.5Fixed in:3.0.5CVE-2025-24964derived from NVD

TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionRequired

ScopeChanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploit Intelligence

0.67%probability of exploitation in 30 days

48thpercentile

Moderate risk: more likely to be exploited than 48% of all known CVEs.

References

Exploit1

github.com

Product3

Related Vulnerabilities

Other CWE-1385 vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2024-48849	Critical	9.4	0.9%	-	-
CVE-2025-68930	High	7.1	0.5%	-	-
CVE-2023-0957	High	8.2	0.4%	-	Fix
CVE-2024-23168	Critical	9.8	0.4%	-	-
CVE-2014-125071	Medium	5.5	0.4%	-	Fix
CVE-2023-49805	Medium	6.0	0.4%	-	Fix

Embed a live status badge for CVE-2025-24964

Markdown

[![CVE-2025-24964](https://tridentstack.com/cve/badge/CVE-2025-24964.svg)](https://tridentstack.com/cve/CVE-2025-24964)

HTML

<a href="https://tridentstack.com/cve/CVE-2025-24964"><img src="https://tridentstack.com/cve/badge/CVE-2025-24964.svg" alt="CVE-2025-24964"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

See how it works Start freeThis CVE lookup is free and always will be.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-12-31.