CVE-2026-47429

EUVD-2026-44391
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 57.65%
Affected Products (NVD)
VendorProductVersion
vitest.devvitest
𝑥
< 3.2.5
vitest.devvitest
4.0.0 ≤
𝑥
< 4.1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d
https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8
https://github.com/vitest-dev/vitest/pull/10445
https://github.com/vitest-dev/vitest/pull/9350
https://github.com/vitest-dev/vitest/releases/tag/v3.2.5
https://github.com/vitest-dev/vitest/releases/tag/v4.1.0
https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp
https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp