CVE-2026-112948

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/vitest-dev/vitest/commit/28dc1edfb6ba5a181fe208576989063795aeadb3
https://github.com/vitest-dev/vitest/pull/11578
https://github.com/vitest-dev/vitest/releases/tag/v5.0.5
https://github.com/vitest-dev/vitest/security/advisories/GHSA-p458-7748-mcp3

Configurations

No configuration.

History

20 Oct 2026, 16:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-20 16:17

Updated : 2026-10-20 19:56

NVD link : CVE-2026-112948

Mitre link : CVE-2026-112948

CVE.ORG link : CVE-2026-112948

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-552

Files or Directories Accessible to External Parties

{"id": "CVE-2026-112948", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-112948", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T16:16:51.150771Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "vitest-dev", "product": "vitest", "versions": [{"status": "affected", "version": ">= 5.0.0-beta.6, < 5.0.5"}]}, {"vendor": "@vitest", "product": "browser", "versions": [{"status": "affected", "version": ">= 5.0.0-beta.6, < 5.0.5"}]}, {"vendor": "@vitest", "product": "ui", "versions": [{"status": "affected", "version": ">= 5.0.0-beta.6, < 5.0.5"}]}, {"vendor": "vitejs", "product": "vite-plus", "versions": [{"status": "affected", "version": ">= 1.0.0-rc.0, < 1.3.0"}]}]}], "published": "2026-10-20T16:17:05.517", "references": [{"url": "https://github.com/vitest-dev/vitest/commit/28dc1edfb6ba5a181fe208576989063795aeadb3", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitest-dev/vitest/pull/11578", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.5", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-p458-7748-mcp3", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-552"}]}], "descriptions": [{"lang": "en", "value": "Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5."}], "lastModified": "2026-10-20T19:56:45.543", "sourceIdentifier": "security-advisories@github.com"}