CVE-2026-47429
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A vulnerability in the Vitest testing framework on Windows allows reading files outside the project via path traversal in /__vitest_attachment__ and arbitrary code execution through saveTestFile and rerun API functions. Fixed in versions 3.2.5 and 4.1.0.
Risk Assessment
An attacker can access sensitive system files or execute arbitrary code on the server, compromising data confidentiality and integrity.
Recommendation
Immediately update Vitest to version 3.2.5 or 4.1.0. Restrict access to the Vitest UI/API server to trusted networks only.
Original NVD description (English source)
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.