Read the docs
TI-2026-76917 Aliases CVE-2026-112950GHSA-xp26-3454-mjgp

Backslash traversal in Vitest mocker exposes files on Windows

Priority MEDIUM 60CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Vitest and @vitest/mocker from 4.1.11 before 4.1.12 and from 5.0.0-rc.2 before 5.0.3 are affected. On Windows, the mocker's redirect path check and the later file read treat backslashes differently, so a path traversal (CWE-22) survives the check. A remote, unauthenticated client that can reach the Vite dev server can register a redirect mock and read files outside server.fs.allow that the Vitest process can access.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00542 45th percentileScored 2026-11-07
Fix Fixed vitest (vitest-dev): 4.1.12, 5.0.3mocker (@vitest): 4.1.12, 5.0.3+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vitest-devvitest4.1.11 to before 4.1.12; 5.0.0-rc.2 to before 5.0.34.1.12, 5.0.3Patch availableCNA
@vitestmocker4.1.11 to before 4.1.12; 5.0.0-rc.2 to before 5.0.34.1.12, 5.0.3Patch availableCNA
—@vitest/mocker (npm)4.1.11 to before 4.1.124.1.12Patch availableGHSA-xp26-3454-mjgp
—@vitest/mocker (npm)5.0.0-rc.2 to before 5.0.35.0.3Patch availableGHSA-xp26-3454-mjgp
  • vitest Vendorvitest-dev Affected 4.1.11 to before 4.1.12; 5.0.0-rc.2 to before 5.0.3 Fixed in 4.1.12, 5.0.3 Patch available CNA
  • mocker Vendor@vitest Affected 4.1.11 to before 4.1.12; 5.0.0-rc.2 to before 5.0.3 Fixed in 4.1.12, 5.0.3 Patch available CNA
  • @vitest/mocker (npm) Vendor— Affected 4.1.11 to before 4.1.12 Fixed in 4.1.12 Patch available GHSA-xp26-3454-mjgp
  • @vitest/mocker (npm) Vendor— Affected 5.0.0-rc.2 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-xp26-3454-mjgp

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:*:*:*——vitest-dev
  • cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:*:*:* Versions — — ·vitest-dev

Remediation

Upgrade vitest and @vitest/mocker to version 4.1.12 in the 4.x line and to version 5.0.3 in the 5.x line.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA vitest (vitest-dev) Fixed in 4.1.12, 5.0.3
  • Fix · CNA mocker (@vitest) Fixed in 4.1.12, 5.0.3
  • Fix · GHSA-xp26-3454-mjgp @vitest/mocker (npm) Fixed in 4.1.12 Advisory →
  • Fix · GHSA-xp26-3454-mjgp @vitest/mocker (npm) Fixed in 5.0.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-112950
  2. 2026-10-21 Alias added: GHSA-xp26-3454-mjgp
  3. 2026-10-21 Fix available: npm/@vitest/[email protected], npm/@vitest/[email protected] · GHSA-xp26-3454-mjgp
  4. 2026-10-21 CVSS score added · GHSA-xp26-3454-mjgp
  5. 2026-10-21 Weakness changed · GHSA-xp26-3454-mjgp
  6. 2026-10-21 7 new references · GHSA-xp26-3454-mjgp
  7. 2026-10-22 Priority changed: MEDIUM → LOW
  8. 2026-10-28 CISA SSVC decision points changed
  9. 2026-10-28 Priority changed: LOW → MEDIUM
  10. 2026-11-06 Affected versions changed · Red Hat
  11. 2026-11-06 CVSS score added · Red Hat

References

Advisory 1

Other 6

  • TI-2026-38677 Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE CVSS 3.1CRITICAL 9.8
  • TI-2026-34992 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening CVSS 3.1CRITICAL 9.8
  • TI-2026-34991 Vitest browser mode serves unsanitized otelCarrier query parameter as inline script CVSS 3.1CRITICAL 9.6
  • TI-2025-18644 Remote Code Execution when accessing a malicious website while Vitest API server is listening CVSS 3.1CRITICAL 9.7
  • TI-2025-18643 Browser mode serves arbitrary files in vitest CVSS 3.1HIGH 7.5
  • TI-2026-76916 Code injection in Vitest manual mock registration CVSS 3.1MEDIUM 4.7
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences