CVE-2026-112950

MEDIUM 5.9

Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.

CWE	CWE-22
Vendor	vitest-dev
Product	vitest
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for vitest-dev vitest

Be the first to know when new medium vulnerabilities affecting vitest-dev vitest are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

vitest-dev / vitest

>= 4.1.11, < 4.1.12 >= 5.0.0-rc.2, < 5.0.3

@vitest / mocker

>= 4.1.11, < 4.1.12 >= 5.0.0-rc.2, < 5.0.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/vitest-dev/vitest/security/advisories/GHSA-xp26-3454-mjgp github.com: https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35 github.com: https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473 github.com: https://github.com/vitest-dev/vitest/releases/tag/v4.1.12 github.com: https://github.com/vitest-dev/vitest/releases/tag/v5.0.3