Log in Start free

Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M

CVE-2026-112950Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

Medium 5.9

In plain English

A medium-severity path traversal in mocker from @vitest. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.5%top 54.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@vitest/mocker4.1.12GHSA-xp26-3454-mjgp
npm@vitest/mocker5.0.3GHSA-xp26-3454-mjgp

Affected products (as reported)

VendorProductVersions
vitest-dev vitest >= 4.1.11, < 4.1.12>= 5.0.0-rc.2, < 5.0.3
@vitest mocker >= 4.1.11, < 4.1.12>= 5.0.0-rc.2, < 5.0.3

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References