# Risk map — mochajs/mocha

> Canonical page: https://codevetter.com/unpack/mocha/risk-map

# Risk map — mochajs/mocha

Scanned commit 79db2ee53b863813b97bf2a74cafa1599115c074 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Mocha intentionally executes local configuration, plugins, and tests with process privileges. Sensitive boundaries include worker option evaluation, child-process environment inheritance, caller-selected output paths, and process-level exception handling. Browser support and documentation generation also have validation and external-service limits.
- Configuration discovery ascends from cwd, and JavaScript rc files execute through require; --require and custom reporter loading also execute resolved user modules. These paths require trusted local inputs. — [lib/cli/config.cjs#L17-L23](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/cli/config.cjs#L17-L23) [lib/cli/config.cjs#L53-L64](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/cli/config.cjs#L53-L64) [lib/cli/config.cjs#L109-L114](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/cli/config.cjs#L109-L114) [lib/cli/run-helpers.cjs#L102-L109](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/cli/run-helpers.cjs#L102-L109) [lib/cli/run-helpers.cjs#L285-L297](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/cli/run-helpers.cjs#L285-L297)
- Parallel options are serialized with unsafe:true and ignoreFunction:true, then evaluated by worker run; worker creation copies process.env and adds MOCHA_WORKER_ID. — [lib/nodejs/buffered-worker-pool.cjs#L85-L94](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/nodejs/buffered-worker-pool.cjs#L85-L94) [lib/nodejs/buffered-worker-pool.cjs#L166-L171](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/nodejs/buffered-worker-pool.cjs#L166-L171) [lib/nodejs/worker.cjs#L80-L95](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/nodejs/worker.cjs#L80-L95)
- init and reporter output use caller-selected paths without a repository-root confinement check in the inspected functions; init writes fixed filenames and JSON output overwrites its destination. — [lib/cli/init.js#L23-L35](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/cli/init.js#L23-L35) [lib/reporters/json.js#L83-L86](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/reporters/json.js#L83-L86) [lib/reporters/xunit.js#L63-L73](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/reporters/xunit.js#L63-L73)
- The executable can spawn Node with inherited stdio, remap /dev/fd descriptors, and forward termination signals; worker completion removes all uncaughtException and unhandledRejection listeners in its process. — [bin/mocha.js#L99-L124](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/bin/mocha.js#L99-L124) [bin/mocha.js#L126-L158](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/bin/mocha.js#L126-L158) [lib/nodejs/worker.cjs#L128-L131](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/nodejs/worker.cjs#L128-L131)
- Buffered parallel reporting can lose a crashing worker's earlier passing events before flush; an integration test explicitly expects that loss while checking attribution to the crashing spec file. — [lib/nodejs/reporters/parallel-buffered.cjs#L109-L119](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/nodejs/reporters/parallel-buffered.cjs#L109-L119) [test/integration/parallel.spec.cjs#L80-L96](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/test/integration/parallel.spec.cjs#L80-L96)
- Module loading branches on process.features.require_module and has error-specific require/import fallbacks; watch rebuilding manipulates the require cache and rebinds interfaces, making module-cache behavior a sensitive compatibility area. — [lib/nodejs/esm-utils.cjs#L94-L134](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/nodejs/esm-utils.cjs#L94-L134) [lib/nodejs/esm-utils.cjs#L138-L148](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/nodejs/esm-utils.cjs#L138-L148) [lib/cli/watch-run.cjs#L127-L165](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/cli/watch-run.cjs#L127-L165) [lib/nodejs/file-unloader.js#L16-L26](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/lib/nodejs/file-unloader.js#L16-L26)
- Hypothesis: the browser test server should remain a development-only service because it serves repository files, binds without an explicit host, and its containment check is lexical rather than a realpath/symlink check; no exploit was validated. (inferred) — [test/browser/server.js#L79-L100](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/test/browser/server.js#L79-L100) [playwright.config.js#L17-L21](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/playwright.config.js#L17-L21)
- Docs generation fetches remote avatar URLs with a timeout and rejects HTML responses, while GraphQL pagination has no explicit timeout in the inspected request; production Netlify builds can fail the supporter-download success threshold. — [docs/_data/supporters.cjs#L104-L129](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/docs/_data/supporters.cjs#L104-L129) [docs/_data/supporters.cjs#L140-L158](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/docs/_data/supporters.cjs#L140-L158) [docs/_data/supporters.cjs#L276-L293](https://github.com/mochajs/mocha/blob/79db2ee53b863813b97bf2a74cafa1599115c074/docs/_data/supporters.cjs#L276-L293)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)