Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-112948 · Microsoft / collected KEV context

EUVD-2026-105143

GHSA-p458-7748-mcp3

cve-program · CVE-2026-112948

• https://github.com/vitest-dev/vitest/security/advisories/GHSA-p458-7748-mcp3
• https://github.com/vitest-dev/vitest/pull/11578
• https://github.com/vitest-dev/vitest/commit/28dc1edfb6ba5a181fe208576989063795aeadb3
• https://github.com/vitest-dev/vitest/releases/tag/v5.0.5

euvd · EUVD-2026-105143

• https://github.com/vitest-dev/vitest/security/advisories/GHSA-p458-7748-mcp3
• https://github.com/vitest-dev/vitest/pull/11578
• https://github.com/vitest-dev/vitest/commit/28dc1edfb6ba5a181fe208576989063795aeadb3
• https://github.com/vitest-dev/vitest/releases/tag/v5.0.5

nvd · CVE-2026-112948

• https://github.com/vitest-dev/vitest/commit/28dc1edfb6ba5a181fe208576989063795aeadb3
• https://github.com/vitest-dev/vitest/pull/11578
• https://github.com/vitest-dev/vitest/releases/tag/v5.0.5
• https://github.com/vitest-dev/vitest/security/advisories/GHSA-p458-7748-mcp3

osv · GHSA-p458-7748-mcp3

• https://github.com/vitest-dev/vitest/security/advisories/GHSA-p458-7748-mcp3
• https://nvd.nist.gov/vuln/detail/CVE-2026-112948
• https://github.com/vitest-dev/vitest/pull/11578
• https://github.com/vitest-dev/vitest/commit/28dc1edfb6ba5a181fe208576989063795aeadb3
• https://github.com/vitest-dev/vitest
• https://github.com/vitest-dev/vitest/releases/tag/v5.0.5

No related operational record is retained in the current change model.