CVE-2026-112950
Description
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.
How to fix
- @vitest/mocker4.1.12, 5.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| @vitest/mockernpm | 4.1.11 ≤ v < 4.1.12, 5.0.0-rc.2 ≤ v < 5.0.3 | 4.1.12, 5.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.