{"id":"EUVD-2026-105152","enisaUuid":"661e6b04-0aa4-311e-a724-2e23381da07f","description":"Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.","datePublished":"Oct 20, 2026, 3:21:32 PM","dateUpdated":"Oct 28, 2026, 2:04:58 PM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/vitest-dev/vitest/security/advisories/GHSA-xp26-3454-mjgp\nhttps://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35\nhttps://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473\nhttps://github.com/vitest-dev/vitest/releases/tag/v4.1.12\nhttps://github.com/vitest-dev/vitest/releases/tag/v5.0.3\n","aliases":"CVE-2026-112950\nGHSA-xp26-3454-mjgp\n","assigner":"GitHub_M","epss":0.46,"enisaIdProduct":[{"id":"17961d28-7b0c-33b0-bb49-6106193bbb74","product":{"name":"mocker","vendor":{"name":"@vitest"}},"product_version":"5.0.0-rc.2, \u003c 5.0.3"},{"id":"5f733200-1e2c-3b1e-8975-5bdf4a3e7c76","product":{"name":"vitest","vendor":{"name":"vitest-dev"}},"product_version":"5.0.0-rc.2, \u003c 5.0.3"},{"id":"b1193c67-053f-3119-a962-79a3b12287a9","product":{"name":"vitest","vendor":{"name":"vitest-dev"}},"product_version":"4.1.11, \u003c 4.1.12"},{"id":"db51f21d-d558-3e93-bdaa-95e668e38dfe","product":{"name":"mocker","vendor":{"name":"@vitest"}},"product_version":"4.1.11, \u003c 4.1.12"}],"enisaIdVendor":[{"id":"1b0000af-16e6-373e-9b66-79b177d28e96","vendor":{"name":"@vitest"}},{"id":"531653ac-1c28-3541-bf87-b3027c8164ed","vendor":{"name":"vitest-dev"}}],"enisaIdVulnerability":[{"id":"675bdb21-21e6-3fe8-83b9-8ba24b395734","vulnerability":{"id":"CVE-2026-112950","description":"Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.","datePublished":"Oct 20, 2026, 3:21:32 PM","dateUpdated":"Oct 28, 2026, 2:04:58 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/vitest-dev/vitest/security/advisories/GHSA-xp26-3454-mjgp\nhttps://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35\nhttps://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473\nhttps://github.com/vitest-dev/vitest/releases/tag/v4.1.12\nhttps://github.com/vitest-dev/vitest/releases/tag/v5.0.3\n","enisa_id":"EUVD-2026-105152\n","assigner":"GitHub_M","epss":0.46,"dataProcessed":"Oct 30, 2026, 3:00:58 AM","vulnerabilityProduct":[{"id":"2e7e9a36-58bd-3f91-aeee-bb9db36afe6d","product":{"name":"mocker","vendor":{"name":"@vitest"}},"product_version":"5.0.0-rc.2, \u003c 5.0.3"},{"id":"814d44c6-9fd5-3999-9485-63fb2f618568","product":{"name":"vitest","vendor":{"name":"vitest-dev"}},"product_version":"5.0.0-rc.2, \u003c 5.0.3"},{"id":"c276d721-74f6-3c7b-a47b-44b00a55be30","product":{"name":"mocker","vendor":{"name":"@vitest"}},"product_version":"4.1.11, \u003c 4.1.12"},{"id":"fcc3d475-a747-3527-a000-7409c27e71d5","product":{"name":"vitest","vendor":{"name":"vitest-dev"}},"product_version":"4.1.11, \u003c 4.1.12"}],"vulnerabilityVendor":[{"id":"e3da997e-7dee-3afd-aaf1-9126b2f6f238","vendor":{"name":"vitest-dev"}},{"id":"f300df20-e3f0-3f28-aa7e-e497cabf47f8","vendor":{"name":"@vitest"}}]}},{"id":"86dcd36c-00fd-3ca4-b173-c99e16cf88b7","vulnerability":{"id":"GHSA-xp26-3454-mjgp","description":"Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix","datePublished":"Oct 21, 2026, 7:48:38 PM","dateUpdated":"Oct 21, 2026, 7:48:38 PM","baseScore":0.0,"references":"https://github.com/vitest-dev/vitest/security/advisories/GHSA-xp26-3454-mjgp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112950\nhttps://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35\nhttps://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473\nhttps://github.com/vitest-dev/vitest\nhttps://github.com/vitest-dev/vitest/releases/tag/v4.1.12\nhttps://github.com/vitest-dev/vitest/releases/tag/v5.0.3\n","enisa_id":"EUVD-2026-105152\n","aliases":"CVE-2026-112950\nGHSA-xp26-3454-mjgp\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}