Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-47429 · Microsoft / collected KEV context

GHSA-5xrq-8626-4rwp

cve-program · CVE-2026-47429

• https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp
• https://github.com/vitest-dev/vitest/pull/10445
• https://github.com/vitest-dev/vitest/pull/9350
• https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d
• https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8
• https://github.com/vitest-dev/vitest/releases/tag/v3.2.5
• https://github.com/vitest-dev/vitest/releases/tag/v4.1.0

nvd · CVE-2026-47429

• https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d
• https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8
• https://github.com/vitest-dev/vitest/pull/10445
• https://github.com/vitest-dev/vitest/pull/9350
• https://github.com/vitest-dev/vitest/releases/tag/v3.2.5
• https://github.com/vitest-dev/vitest/releases/tag/v4.1.0
• https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp

osv · GHSA-5xrq-8626-4rwp

• https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp
• https://nvd.nist.gov/vuln/detail/CVE-2026-47429
• https://github.com/vitest-dev/vitest/pull/10445
• https://github.com/vitest-dev/vitest/pull/9350
• https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d
• https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8
• https://github.com/vitest-dev/vitest
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/commands/fs.ts#L10-L11
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/plugin.ts#L194-L196
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/rpc.ts#L115-L121
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/ui/node/index.ts#L77
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L103-L105
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L119-L121
• https://github.com/vitest-dev/vitest/releases/tag/v3.2.5
• https://github.com/vitest-dev/vitest/releases/tag/v4.1.0

No related operational record is retained in the current change model.