Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-14T19:28:08 vitest: Vitest: Arbitrary code execution and information disclosure via path traversal 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-22

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

A flaw was found in Vitest, a testing framework. On Windows, the Vitest UI/API server incorrectly handled file serving, which could allow an attacker to read sensitive files outside the project directory. Additionally, exposed API features could be exploited to execute arbitrary scripts, leading to potential system compromise.

Vitest ships a UI and API server (enabled via the --ui or --api flags, or automatically as part of Browser Mode) that exposes file read, file write, and test-rerun functionality over HTTP. Due to an incorrect path-traversal check in the /__vitest_attachment__ handler and related code paths, a remote attacker who can reach this server can read arbitrary files, and via the write/rerun features can achieve arbitrary code execution. Exploitation requires either exposing the server to a network host (--api.host / api.host config) or running the UI/Browser Mode on Windows. Red Hat's shipped products use vitest exclusively as a development-time unit test runner (invoked as `vitest run`, `test:unit`, or `--project` in CI/build pipelines). None of the Red Hat products that ship vitest start its UI server, API server, or Browser Mode as part of their build process or shipped runtime. The @vitest/browser package (required for Browser Mode) is not present in any Red Hat product's manifest. As a result, the vulnerable code path is not reachable in any Red Hat product covered by this flaw, and affects are set to NOTAFFECTED / Vulnerable Code not in Execute Path. No mitigation is required for Red Hat products, as none run Vitest's UI/API server or Browser Mode in their build or shipped runtime. Developers who run `vitest --ui`, `vitest --api`, or Browser Mode interactively should avoid binding the server to a non-localhost host, and should upgrade to vitest >= 4.1.0 (or >= 3.2.5 on the 3.x branch), where the allowWrite/allowExec flags default to disabled whenever the server is bound to a non-localhost host. Red Hat Hardened Images 2026-07-13T00:00:00Z RHSA-2026:39058 prometheus3-13-main-3.13.1-0.1.hum1 Red Hat AMQ Broker 7 Not affected vitest Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-27/gateway-rhel9 Red Hat Ansible Automation Platform 2 Not affected automation-platform-ui Red Hat Build of Keycloak Not affected vitest Red Hat Build of Podman Desktop Not affected rh-podman-desktop.git Red Hat JBoss Enterprise Application Platform 8 Not affected vitest Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected vitest Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-agent-installer-ui-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-47429 https://nvd.nist.gov/vuln/detail/CVE-2026-47429 https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8 https://github.com/vitest-dev/vitest/pull/10445 https://github.com/vitest-dev/vitest/pull/9350 https://github.com/vitest-dev/vitest/releases/tag/v3.2.5 https://github.com/vitest-dev/vitest/releases/tag/v4.1.0 https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp