Junglewise Threat Intelligence

CVE-2026-47429: Vitest path traversal and remote code execution in UI/API server

CVE-2026-47429 · Severity: critical · CVSS 9.8 · Published 2026-07-14

Technologies: Vitest. Vendors: Vitest.

Executive brief

Vitest, a popular JavaScript testing framework, contains critical vulnerabilities in its UI and API server that allow unauthenticated remote attackers to read arbitrary files and execute code on systems where the server is exposed to the network. An attacker can exploit path traversal techniques to bypass security checks and execute arbitrary test files or modify the system, effectively granting complete system access to anyone who can reach the exposed server.

Technical details

The vulnerability involves multiple improper path validation issues in Vitest's UI and API server components. The isFileServingAllowed function is called incorrectly without applying path normalization (cleanUrl) before filesystem operations, allowing Windows path traversal bypass using sequences like \\?\\..\\. This affects the /__vitest_attachment__ handler and multiple other API endpoints across ui/node, api/setup, and browser mode components. Additionally, the rerun and saveTestFile features allow arbitrary script execution, and readFile/writeFile operations in browser mode provide file access without adequate privilege checks. The vulnerability requires network reachability to the Vitest API server (exposed via --api.host), and no authentication is needed when allowWrite/allowExec flags are not explicitly disabled. Patches introduce mandatory allowWrite and allowExec configuration flags, both disabled by default for non-localhost bindings, and disable interactive UI features in read-only mode.

Affected products

  • Vitest Vitest >=4.0.0,<4.1.0 and <3.2.5

Timeline

  • 2026-06-01: disclosed: Vulnerability publicly disclosed in GHSA-5xrq-8626-4rwp
  • 2026-01-29: patched: Fix merged in PR #9350 (main branch) - allowWrite and allowExec options added
  • 2026-05-28: patched: Fix backported to v3 branch in PR #10445
  • 2026: other: Patches released as Vitest v3.2.5 and v4.1.0

References