CVE-2026-112948: Vitest Information Disclosure Vulnerability

CVE-2026-112948 Overview

CVE-2026-112948 is an information disclosure vulnerability in Vitest, a testing framework powered by Vite. The flaw affects versions 5.0.0-beta.6 through 5.0.4 and stems from misapplication of the server.fs.deny filesystem restriction in Vitest dev servers. Project servers replace Vite's default deny list, while the root server appends .vitest-secret-token only after Vite compiles its matcher. An attacker who can reach an exposed UI, Browser Mode, or API server can read protected project files or the fallback API token at node_modules/.vitest/.vitest-secret-token. Browser Mode with test.projects can also leak JavaScript-compatible .env values to malicious websites. The issue is categorized under [CWE-200].

Critical Impact
Remote attackers can retrieve the Vitest fallback API token and denied project files, enabling further compromise of the development environment.

Affected Products

Vitest 5.0.0-beta.6 through 5.0.4
Vitest UI server, Browser Mode, and API server components
Projects using Browser Mode with test.projects configuration

Discovery Timeline

2026-10-20 - CVE-2026-112948 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-112948

Vulnerability Analysis

Vitest dev servers expose HTTP endpoints that should restrict filesystem access through Vite's server.fs.deny option. In affected versions, two independent code paths break that restriction. Project servers overwrite Vite's defaults rather than extending them, removing baseline protections. The root server appends the sensitive entry .vitest-secret-token to the deny list, but it does so after Vite has already compiled its path matcher. The late addition is never enforced.

An attacker who can reach the dev server over the network can request paths that should be blocked. The fallback API token stored at node_modules/.vitest/.vitest-secret-token becomes retrievable, as do other denied project files. In Browser Mode configurations that use test.projects, a malicious website loaded by the developer can read JavaScript-compatible values from .env files through the exposed server.

Root Cause

The root cause is incorrect construction and ordering of the filesystem deny list. Project servers replace rather than merge Vite's default denied paths, and the root server mutates the deny list after Vite's internal matcher has been built. Both conditions result in protected paths being served to unauthenticated clients.

Attack Vector

Exploitation requires network reachability to a running Vitest dev server and user interaction, such as a developer visiting an attacker-controlled page. The attacker issues HTTP requests to the UI, Browser Mode, or API server to retrieve the fallback API token or other restricted files. With the token, the attacker can call privileged Vitest endpoints. See the GitHub Security Advisory GHSA-p458-7748-mcp3 for the full technical write-up.

Detection Methods for CVE-2026-112948

Indicators of Compromise

HTTP requests to Vitest dev server endpoints targeting paths containing .vitest-secret-token or node_modules/.vitest/
Outbound requests from developer workstations to unknown origins immediately after loading Vitest UI or Browser Mode
Access attempts to project .env files served by a Vitest process

Detection Strategies

Inspect developer workstation process telemetry for vitest processes bound to non-loopback interfaces
Review web proxy logs for cross-origin requests that reference Vitest dev server ports during active test sessions
Audit source repositories and CI pipelines for Vitest versions in the vulnerable range 5.0.0-beta.6 through 5.0.4

Monitoring Recommendations

Alert on Vitest dev servers listening on 0.0.0.0 or externally routable interfaces in developer environments
Monitor for unexpected reads of node_modules/.vitest/.vitest-secret-token on build servers and workstations
Track browser navigation events during active test sessions to detect visits to untrusted domains

How to Mitigate CVE-2026-112948

Immediate Actions Required

Upgrade Vitest to version 5.0.5 or later across all projects, CI pipelines, and developer workstations
Terminate any running Vitest dev server instances on vulnerable versions until the upgrade is applied
Rotate any secrets exposed through .env files that may have been served by a Vitest dev server

Patch Information

The vulnerability is fixed in Vitest 5.0.5. The fix merges Vitest's deny entries with Vite's defaults and ensures .vitest-secret-token is added before the path matcher is compiled. See the Vitest Release v5.0.5, the GitHub Pull Request #11578, and the GitHub Commit Update for implementation details.

Workarounds

Bind the Vitest dev server to localhost only and block external access through host firewall rules
Avoid using Browser Mode with test.projects on untrusted networks until the upgrade is complete
Remove sensitive values from .env files consumed by Vitest during test runs and inject them through CI secrets instead

bash

# Configuration example
npm install --save-dev vitest@^5.0.5
npm ls vitest