CVE-2026-47429: Vitest path traversal and remote code execution in UI/API server

CVE-2026-47429 · Severity: critical · CVSS 9.8 · Published 2026-07-14

Vitest, a popular JavaScript testing framework, contains critical vulnerabilities in its UI and API server that allow unauthenticated remote attackers to read arbitrary files and execute code on systems where the server is exposed to the network. An attacker can exploit path traversal techniques to bypass security checks and execute arbitrary test files or modify the system, effectively granting complete system access to anyone who can reach the exposed server.

Technologies: Vitest.

Quick answers

Is CVE-2026-47429 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47429 being exploited in the wild.
How severe is CVE-2026-47429?
Critical severity, with a CVSS score of 9.8, published 14 July 2026.
Which products and versions are affected?
Vitest < 4.1.0, SEMVER:introduced=4.0.0,fixed=4.1.0.
Is there a fix for CVE-2026-47429?
Yes. Vitest: upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47429 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47429?
Check whether you run Vitest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Vitest: upgrade to 4.1.0 or later

Technical details

The vulnerability involves multiple improper path validation issues in Vitest's UI and API server components. The isFileServingAllowed function is called incorrectly without applying path normalization (cleanUrl) before filesystem operations, allowing Windows path traversal bypass using sequences like \\?\\..\\. This affects the /__vitest_attachment__ handler and multiple other API endpoints across ui/node, api/setup, and browser mode components. Additionally, the rerun and saveTestFile features allow arbitrary script execution, and readFile/writeFile operations in browser mode provide file access without adequate privilege checks. The vulnerability requires network reachability to the Vitest API server (exposed via --api.host), and no authentication is needed when allowWrite/allowExec flags are not explicitly disabled. Patches introduce mandatory allowWrite and allowExec configuration flags, both disabled by default for non-localhost bindings, and disable interactive UI features in read-only mode.

Affected products

  • Vitest Vitest >=4.0.0,<4.1.0 and <3.2.5

Identifiers

  • CVE-2026-47429
  • GHSA-5xrq-8626-4rwp

Timeline

  • 2026-06-01: disclosed: Vulnerability publicly disclosed in GHSA-5xrq-8626-4rwp
  • 2026-01-29: patched: Fix merged in PR #9350 (main branch) - allowWrite and allowExec options added
  • 2026-05-28: patched: Fix backported to v3 branch in PR #10445
  • 2026: other: Patches released as Vitest v3.2.5 and v4.1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.