CVE-2026-47429 Details
Description
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.
A vulnerability in Vitest's UI/API server on Windows prior to versions 3.2.5 and 4.1.0 allows for path traversal attacks. By exploiting the incorrect handling of file serving permissions, an attacker can read files outside the project directory. Additionally, the exposed API features for writing and re-running tests could be misused to execute arbitrary scripts. This vulnerability arises when the Vitest UI server is exposed to the network, particularly on Windows systems.
Users can update to Vitest versions 3.2.5 or 4.1.0, where this vulnerability has been patched. After updating, be cautious when re-enabling the 'allowWrite' and 'allowExec' options, as they can introduce similar risks if the UI is exposed to the network.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d | [email protected] | Patch |
| https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8 | [email protected] | Patch |
| https://github.com/vitest-dev/vitest/pull/10445 | [email protected] | ExploitIssue TrackingPatch |
| https://github.com/vitest-dev/vitest/pull/9350 | [email protected] | ExploitIssue TrackingPatch |
| https://github.com/vitest-dev/vitest/releases/tag/v3.2.5 | [email protected] | Release Notes |
| https://github.com/vitest-dev/vitest/releases/tag/v4.1.0 | [email protected] | Release Notes |
| https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vitest.dev vitest | < 3.2.5 >= 4.0.0, < 4.1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |