CVE-2026-47429CWE-22path-traversal

CVE-2026-47429

Critical · published July 15, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
58.6
In the wild
Unconfirmed
What it is

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00876 · 58.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-15T00:17Z
Affected products (2)
ProductVersionsFixed in
vitest.dev/vitest< 3.2.53.2.5
vitest.dev/vitest≥ 4.0.0, < 4.1.04.1.0
References (8)
https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d · [email protected]https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8 · [email protected]https://github.com/vitest-dev/vitest/pull/10445 · [email protected]https://github.com/vitest-dev/vitest/pull/9350 · [email protected]https://github.com/vitest-dev/vitest/releases/tag/v3.2.5 · [email protected]https://github.com/vitest-dev/vitest/releases/tag/v4.1.0 · [email protected]https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp · [email protected]https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 JUL 19:28Z
    Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
    cvelistv5