Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
Summary
| CVE | CVE-2026-84373 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-01 22:17:19 UTC |
| Updated | 2026-09-01 22:17:19 UTC |
| Description | Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2. |
Risk And Classification
Primary CVSS: v3.1 5.9 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-22 | CWE-22 CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | DECLARED | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Vitest-dev | Vitest | affected >= 2.1.0, < 4.1.11 | Not specified |
| CNA | Vitest-dev | Vitest | affected >= 5.0.0-beta.1, < 5.0.0-rc.2 | Not specified |
| CNA | @vitest | Mocker | affected >= 2.1.0, < 4.1.11 | Not specified |
| CNA | @vitest | Mocker | affected >= 5.0.0-beta.1, < 5.0.0-rc.2 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2 | [email protected] | github.com | |
| github.com/vitest-dev/vitest/pull/10974 | [email protected] | github.com | |
| github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33... | [email protected] | github.com | |
| github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9 | [email protected] | github.com | |
| github.com/vitest-dev/vitest/pull/10972 | [email protected] | github.com | |
| github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6... | [email protected] | github.com | |
| github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132... | [email protected] | github.com | |
| github.com/vitest-dev/vitest/releases/tag/v4.1.11 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.