CVE-2026-47428: Critical Reflected XSS in Vitest Browser Mode via Unsanitized otelCarrier Parameter

Vulnerability Overview

CVE-2026-47428 is a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) in the @vitest/browser package. The root cause is straightforward but severe: the browser mode development server reflects the otelCarrier query parameter directly into inline script content in two locations — esm-client-injector.js and serverOrchestrator.ts — without any sanitization or encoding. This means an attacker who can control or influence the URL presented to a developer's browser can inject and execute arbitrary JavaScript in the test runner's browser context. With a CVSS score of 9.6, this is a critical-severity finding.

Affected Software

The vulnerability affects the npm package @vitest/browser in the following version ranges:

• >= 4.0.17, < 4.1.6
• >= 5.0.0-beta.0, < 5.0.0-beta.3

No patch date has been confirmed at time of publication. Organizations using Vitest browser mode in either of these ranges should treat this as an active risk until an upgrade or workaround is in place.

Exploitation Status and Defender Implications

A public proof-of-concept is available, which materially lowers the bar for exploitation. This is not a theoretical edge case — any attacker with the ability to deliver a crafted URL to a developer or CI agent running Vitest browser mode tests can trigger code execution in that browser context.

The attack surface sits squarely in developer tooling and CI/CD pipelines, environments that are often trusted implicitly and monitored less rigorously than production. Realistic impact scenarios include credential theft (e.g., stealing tokens or cookies present in the browser session), session hijacking against internal tooling, and supply chain compromise if the injected script is able to tamper with test output or exfiltrate source artifacts. The fact that this runs in a development server context — not a locked-down production environment — makes lateral movement from a single compromised workstation a credible follow-on.

Detection Coverage

The df00tech detection platform ships detection logic for CVE-2026-47428 across seven SIEM platforms:

• Microsoft Sentinel (KQL)
• Splunk (SPL)
• Elastic (EQL)
• IBM QRadar (AQL)
• Sumo Logic
• Google Chronicle (YARA-L)
• CrowdStrike (CQL)

Detection logic targets observable indicators of exploitation: HTTP requests to Vitest browser mode development server endpoints containing a suspicious otelCarrier query parameter — specifically, values that include script injection payloads (encoded or plaintext), unexpected characters, or patterns inconsistent with legitimate OpenTelemetry carrier propagation. Detections also cover process and network telemetry from CI agents spawning Vitest browser mode processes and receiving anomalous inbound connections or exfiltration-shaped outbound traffic during test runs.

Because this is a dev-tooling vulnerability, detections are tuned to reduce noise in environments where Vitest is legitimately running, focusing on the parameter content anomaly rather than the endpoint alone.

Full Detection and Queries

The complete detection package — including all SIEM queries, triage guidance, and mapped MITRE ATT&CK techniques — is available on the CVE-2026-47428 detection page. If you are running @vitest/browser in any affected version range, deploy these detections immediately and prioritize upgrading or isolating affected test environments.