CVE-2026-112950: Vitest Path Traversal Vulnerability

CVE-2026-112950 Overview

CVE-2026-112950 is a path traversal vulnerability [CWE-22] in Vitest, a Vite-native testing framework for JavaScript and TypeScript projects. The flaw exists in packages/mocker/src/node/interceptorPlugin.ts where isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows. An attacker who can reach the Vite dev server on Windows can register a redirect mock containing backslash traversal sequences. POSIX joining preserves the Windows backslash traversal, which the later filesystem read interprets as a path separator. This allows reading files outside the server.fs.allow boundary that the Vitest process can access. Affected versions span 4.1.11 and earlier in the 4.x branch, with fixes landing in 4.1.12 and 5.0.3.

Critical Impact

Attackers reaching a Windows-hosted Vite dev server can read arbitrary files accessible to the Vitest process, bypassing server.fs.allow restrictions.

Affected Products

• Vitest versions from 4.1.11 and prior in the 4.x branch (Windows only)
• Vitest versions prior to 5.0.3 in the 5.x branch (Windows only)
• Projects exposing the Vite dev server with Vitest mocker enabled on Windows hosts

Discovery Timeline

• 2026-10-20 - CVE-2026-112950 published to NVD
• 2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-112950

Vulnerability Analysis

The vulnerability arises from inconsistent path separator handling between POSIX and Windows semantics inside the Vitest mocker. The interceptor plugin uses join from node:path/posix to build file paths before validating them with Vite's isFileLoadingAllowed. POSIX join treats backslashes as regular characters, not separators, so a path containing ..\ traverses no directories under POSIX rules. Windows filesystem APIs, however, treat both / and \ as valid separators when the resulting string reaches readFile. An attacker-supplied redirect mock URL containing backslash traversal sequences passes the allowlist check as a benign literal, then escapes the intended directory when the OS resolves it. The result is an arbitrary file read scoped to whatever the Vitest process can access on disk.

Root Cause

The root cause is a path parsing confusion between the validator and the consumer. isFileLoadingAllowed and the POSIX join normalize paths using forward-slash semantics only, while Node's readFile on Windows honors backslashes as separators. This mismatch breaks the security assumption that validated paths cannot traverse outside server.fs.allow.

Attack Vector

Exploitation requires network access to the Vite dev server running on a Windows host and the ability to register a redirect mock. The attacker crafts a mock URL embedding backslash traversal, which bypasses the filesystem allowlist and triggers an out-of-scope file read.

// Patch excerpt: packages/mocker/src/node/interceptorPlugin.ts
 import type { MockedModuleSerialized } from '../registry'
 import { readFile } from 'node:fs/promises'
 import { join } from 'node:path/posix'
+import { slash } from '@vitest/utils/helpers'
 import { isFileLoadingAllowed } from 'vite'
 import { ManualMockedModule, MockerRegistry } from '../registry'
 import { cleanUrl, createManualModuleSource } from '../utils'

Source: GitHub Commit b825313. The patch introduces the slash helper to normalize backslashes to forward slashes before validation, eliminating the parser mismatch.

Detection Methods for CVE-2026-112950

Indicators of Compromise

• Dev server access logs containing requests with URL-encoded backslashes (%5C) or literal ..\ sequences targeting mocker endpoints
• Unexpected file reads outside the configured server.fs.allow directories initiated by the Vitest process
• Mock registration requests referencing absolute Windows paths such as C:\Users\ or C:\Windows\

Detection Strategies

• Inspect reverse proxy and Vite dev server logs for requests to mocker routes containing backslash traversal patterns
• Audit running Vitest versions across developer workstations and CI runners to identify instances below 4.1.12 or 5.0.3 on Windows
• Correlate Node.js fs.readFile telemetry on Windows developer hosts with requests originating from the Vitest dev server port

Monitoring Recommendations

• Monitor outbound exposure of the Vite dev server port (default 5173) on Windows machines to non-loopback interfaces
• Alert on process-level file reads by node.exe touching paths outside the project workspace during active Vitest sessions
• Track dependency manifests in CI for pinned Vitest versions and flag regressions to vulnerable releases

How to Mitigate CVE-2026-112950

Immediate Actions Required

• Upgrade Vitest to version 4.1.12 for 4.x deployments or 5.0.3 for 5.x deployments
• Restrict the Vite dev server to the loopback interface by setting server.host to 127.0.0.1 on Windows hosts
• Review server.fs.allow configuration and remove unnecessarily broad allowlist entries

Patch Information

The fix is distributed in GitHub Release v4.1.12 and GitHub Release v5.0.3. The patches, implemented in GitHub Commit 15cc006 and GitHub Commit b825313, normalize backslashes to forward slashes using the slash helper from @vitest/utils/helpers before path validation. Additional hardening serializes mock identifiers through JSON.stringify to prevent injection in generated module sources. See the GitHub Security Advisory GHSA-xp26-3454-mjgp for the complete advisory.

Workarounds

• Bind the Vite dev server to localhost only and prohibit remote access during test runs
• Place the development environment behind firewall rules that block all inbound connections to dev server ports from untrusted networks
• Avoid running Vitest with the dev server exposed on shared or multi-tenant Windows hosts until patched versions are deployed

# Upgrade Vitest to a patched release
npm install --save-dev vitest@4.1.12
# or for the 5.x branch
npm install --save-dev vitest@5.0.3

# Verify the installed version
npx vitest --version