Vulnerability Description
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vitest.Dev | Vitest | < 3.2.5 |
Related Weaknesses (CWE)
References
- https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08fPatch
- https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b1Patch
- https://github.com/vitest-dev/vitest/pull/10445ExploitIssue TrackingPatch
- https://github.com/vitest-dev/vitest/pull/9350ExploitIssue TrackingPatch
- https://github.com/vitest-dev/vitest/releases/tag/v3.2.5Release Notes
- https://github.com/vitest-dev/vitest/releases/tag/v4.1.0Release Notes
- https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwpExploitMitigationVendor Advisory
- https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwpExploitMitigationVendor Advisory
FAQ
What is CVE-2026-47429?
CVE-2026-47429 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path t...
How severe is CVE-2026-47429?
CVE-2026-47429 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-47429?
Check the references section above for vendor advisories and patch information. Affected products include: Vitest.Dev Vitest.