CVE-2026-47429
Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.
| CWE | CWE-22 |
| Vendor | vitest-dev |
| Product | vitest |
| Published | Jul 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for vitest-dev vitest
Be the first to know when new critical vulnerabilities affecting vitest-dev vitest are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
vitest-dev / vitest
< 3.2.5 >= 4.0.0, < 4.1.0
References
github.com: https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp github.com: https://github.com/vitest-dev/vitest/pull/10445 github.com: https://github.com/vitest-dev/vitest/pull/9350 github.com: https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d github.com: https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8 github.com: https://github.com/vitest-dev/vitest/releases/tag/v3.2.5 github.com: https://github.com/vitest-dev/vitest/releases/tag/v4.1.0