CVE-2026-84373: Vitest @vitest/mocker path traversal in redirect mock

CVE-2026-84373 · Severity: medium · CVSS 5.9 · Published 2026-09-01

Vitest's @vitest/mocker plugin, used in development servers, fails to validate file paths when registering redirect mocks. An attacker who can reach an exposed development server's WebSocket can register malicious mocks pointing to sensitive files outside the project directory, causing the plugin to read and leak those files (including source code, .env files with secrets, and system files). This affects developers who expose their local dev server to untrusted networks or run it on shared machines.

Technologies: @vitest/mocker (npm), Vitest. Vendors: npm.

Quick answers

Is CVE-2026-84373 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84373 being exploited in the wild.
How severe is CVE-2026-84373?
Medium severity, with a CVSS score of 5.9, published 1 September 2026.
Which products and versions are affected?
@vitest/mocker (npm) SEMVER:introduced=2.1.0,fixed=4.1.11; Vitest SEMVER:introduced=2.1.0,fixed=4.1.11.
Is there a fix for CVE-2026-84373?
Yes. @vitest/mocker (npm): upgrade to 4.1.11 or later; Vitest: upgrade to 4.1.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84373 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-84373?
Check whether you run @vitest/mocker (npm) or Vitest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @vitest/mocker (npm): upgrade to 4.1.11 or later
    npm install @vitest/mocker@4.1.11
  • Vitest: upgrade to 4.1.11 or later

Technical details

The vulnerability exists in packages/mocker/src/node/interceptorPlugin.ts. The plugin's load hook directly calls readFile() on a mock.redirect path without validating it against Vite's file-serving allowlist (server.fs.allow/deny). The redirect path is derived from untrusted client input via the unauthenticated 'vitest:interceptor:register' HMR WebSocket event with only a basic join(root, pathname) check. Path handling with WHATWG URL parsing allows opaque schemes to preserve directory traversal sequences (e.g., "../../etc/passwd") that bypass the root containment check. The vulnerability requires network access to the dev server's WebSocket—typically bound to localhost but exploitable if exposed via server.host=0.0.0.0 or proxied. Vitest's browser mode uses a token-authenticated RPC for mocks and is not affected remotely. Patches are available in v4.1.11 and v5.0.0-rc.2; older majors (2.1.x, 3.x) are unmaintained.

Affected products

  • vitest-dev @vitest/mocker >=2.1.0, <4.1.11; >=5.0.0-beta.1, <5.0.0-rc.2
  • vitest-dev vitest >=2.1.0, <4.1.11; >=5.0.0-beta.1, <5.0.0-rc.2
  • vitest-dev @vitest/browser >=2.1.0, <4.1.11; >=5.0.0-beta.1, <5.0.0-rc.2

Identifiers

  • CVE-2026-84373
  • GHSA-82fw-gwwq-j7x9

Timeline

  • 2026-09-08: disclosed: Published to GitHub Advisory Database and NVD
  • 2026-09-08: patched: Fixed in vitest v4.1.11 and v5.0.0-rc.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.