CVE-2026-47429

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d	Patch
https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8	Patch
https://github.com/vitest-dev/vitest/pull/10445	Exploit Issue Tracking Patch
https://github.com/vitest-dev/vitest/pull/9350	Exploit Issue Tracking Patch
https://github.com/vitest-dev/vitest/releases/tag/v3.2.5	Release Notes
https://github.com/vitest-dev/vitest/releases/tag/v4.1.0	Release Notes
https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp	Exploit Mitigation Vendor Advisory
https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vitest.dev:vitest::::::node.js::*
	cpe:2.3:a:vitest.dev:vitest::::::node.js::*

History

No history.

Information

Published : 2026-07-14 20:17

Updated : 2026-08-06 18:25

NVD link : CVE-2026-47429

Mitre link : CVE-2026-47429

CVE.ORG link : CVE-2026-47429

JSON object : View

Products Affected

vitest.dev

vitest

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-47429", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47429", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-21T15:02:06.439415Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "vitest-dev", "product": "vitest", "versions": [{"status": "affected", "version": "< 3.2.5"}, {"status": "affected", "version": ">= 4.0.0, < 4.1.0"}]}]}], "published": "2026-07-14T20:17:02.460", "references": [{"url": "https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vitest-dev/vitest/pull/10445", "tags": ["Exploit", "Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vitest-dev/vitest/pull/9350", "tags": ["Exploit", "Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vitest-dev/vitest/releases/tag/v3.2.5", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\\\?\\\\..\\\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0."}], "lastModified": "2026-08-06T18:25:42.477", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "2C5A55A4-130E-4024-8D51-520CE230240D", "versionEndExcluding": "3.2.5"}, {"criteria": "cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "E3EFDF3A-B3CD-4077-B840-4F57324813F5", "versionEndExcluding": "4.1.0", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}