Executive brief
Vitest's @vitest/mocker plugin, used in development servers, fails to validate file paths when registering redirect mocks. An attacker who can reach an exposed development server's WebSocket can register malicious mocks pointing to sensitive files outside the project directory, causing the plugin to read and leak those files (including source code, .env files with secrets, and system files). This affects developers who expose their local dev server to untrusted networks or run it on shared machines.
Technical details
The vulnerability exists in packages/mocker/src/node/interceptorPlugin.ts. The plugin's load hook directly calls readFile() on a mock.redirect path without validating it against Vite's file-serving allowlist (server.fs.allow/deny). The redirect path is derived from untrusted client input via the unauthenticated 'vitest:interceptor:register' HMR WebSocket event with only a basic join(root, pathname) check. Path handling with WHATWG URL parsing allows opaque schemes to preserve directory traversal sequences (e.g., "../../etc/passwd") that bypass the root containment check. The vulnerability requires network access to the dev server's WebSocket—typically bound to localhost but exploitable if exposed via server.host=0.0.0.0 or proxied. Vitest's browser mode uses a token-authenticated RPC for mocks and is not affected remotely. Patches are available in v4.1.11 and v5.0.0-rc.2; older majors (2.1.x, 3.x) are unmaintained.
Affected products
- vitest-dev @vitest/mocker >=2.1.0, <4.1.11; >=5.0.0-beta.1, <5.0.0-rc.2
- vitest-dev vitest >=2.1.0, <4.1.11; >=5.0.0-beta.1, <5.0.0-rc.2
- vitest-dev @vitest/browser >=2.1.0, <4.1.11; >=5.0.0-beta.1, <5.0.0-rc.2
Timeline
- 2026-09-08: disclosed: Published to GitHub Advisory Database and NVD
- 2026-09-08: patched: Fixed in vitest v4.1.11 and v5.0.0-rc.2