Is CVE-2026-112948 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112948 being exploited in the wild.

How severe is CVE-2026-112948?

Medium severity, with a CVSS score of 6.5, published 20 October 2026.

Which products and versions are affected?

@vitest/browser (npm) >= 5.0.0-beta.6, = 5.0.0-beta.6, = 1.0.0-rc.0, < 1.3.0, SEMVER:introduced=1.0.0-rc.0,fixed=1.3.0; Vitest 5.0.0-beta.6 to 5.0.4.

Is there a fix for CVE-2026-112948?

Yes. @vitest/browser (npm): upgrade to 5.0.5 or later; @vitest/ui (npm): upgrade to 5.0.5 or later; vite-plus (npm): upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112948 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-112948?

Check whether you run @vitest/browser (npm), @vitest/ui (npm), vite-plus (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112948: Vitest filesystem deny misapplication in dev servers

Q: Is there a fix for CVE-2026-112948?

Yes. @vitest/browser (npm): upgrade to 5.0.5 or later; @vitest/ui (npm): upgrade to 5.0.5 or later; vite-plus (npm): upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-112948 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-112948?

Check whether you run @vitest/browser (npm), @vitest/ui (npm), vite-plus (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112948 · Severity: medium · CVSS 6.5 · Published 2026-10-20

Vitest is a testing framework that includes dev servers for UI, Browser Mode, and API testing. A misconfiguration of filesystem access controls allowed attackers who can reach these servers to read sensitive files including the .vitest-secret-token fallback API token and other files that should have been protected. This could enable account takeover, token theft, and exposure of environment variables.

Technologies: @vitest/browser (npm), vite-plus (npm), Vitest. Vendors: npm, Vitest.

Quick answers

Is CVE-2026-112948 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112948 being exploited in the wild.
How severe is CVE-2026-112948?: Medium severity, with a CVSS score of 6.5, published 20 October 2026.
Which products and versions are affected?: @vitest/browser (npm) >= 5.0.0-beta.6, < 5.0.5, SEMVER:introduced=5.0.0-beta.6,fixed=5.0.5; @vitest/ui (npm) >= 5.0.0-beta.6, < 5.0.5, SEMVER:introduced=5.0.0-beta.6,fixed=5.0.5; vite-plus (npm) >= 1.0.0-rc.0, < 1.3.0, SEMVER:introduced=1.0.0-rc.0,fixed=1.3.0; Vitest 5.0.0-beta.6 to 5.0.4.
Is there a fix for CVE-2026-112948?: Yes. @vitest/browser (npm): upgrade to 5.0.5 or later; @vitest/ui (npm): upgrade to 5.0.5 or later; vite-plus (npm): upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112948 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-112948?: Check whether you run @vitest/browser (npm), @vitest/ui (npm), vite-plus (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@vitest/browser (npm): upgrade to 5.0.5 or later
```
npm install @vitest/browser@5.0.5
```
@vitest/ui (npm): upgrade to 5.0.5 or later
```
npm install @vitest/ui@5.0.5
```
vite-plus (npm): upgrade to 1.3.0 or later
```
npm install vite-plus@1.3.0
```

Technical details

Vitest dev servers misapply the server.fs.deny configuration because project servers replace Vite's default deny list, and the root server adds .vitest-secret-token to the deny list after Vite has already compiled its matcher. An unauthenticated network attacker reaching the affected UI, Browser Mode, or API server can read denied project files or the fallback API token. Browser Mode with test.projects can additionally expose JavaScript-compatible .env values through a malicious website.

Affected products

Vitest Vitest 5.0.0-beta.6 to 5.0.4

Identifiers

CVE-2026-112948
GHSA-p458-7748-mcp3

Timeline

2026-10-20: disclosed
2026-10-14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.