CVE-2026-112948 in Vitest
Summary
by MITRE • 10/20/2026
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Vitest versions from 5.0.0-beta.6 to 5.0.5 stems from an improper implementation of file system access controls within the development server architecture. Vitest, which leverages Vite for its underlying build and serving capabilities, relies on a configuration directive known as fs.deny to restrict access to sensitive directories such as node_modules or other critical project files. However, during this specific version range, the internal logic governing how these deny rules are applied contains a flaw that allows unauthorized traversal of restricted paths. The core issue arises because Vitest's dev server replaces certain default behaviors provided by Vite without correctly inheriting or reapplying the security constraints in all contexts. Specifically, when the root server initializes and compiles its matcher for file access permissions, it appends a secret token path to the list of denied resources only after the initial configuration is processed. This timing discrepancy means that requests targeting paths intended to be blocked may bypass the deny logic if they are routed through specific endpoints or sub-servers within the Vitest ecosystem before the final security filter is fully enforced.
This architectural flaw results in a significant information disclosure vulnerability, classified under CWE-200 as an Exposure of Sensitive Information to an Unauthorized Actor. An attacker who gains network access to any component of the affected Vitest environment, including the main UI server, Browser Mode interface, or internal API endpoints, can exploit this misconfiguration to read files that were explicitly marked for denial by the developer. The most critical impact involves the retrieval of the fallback API token located at node_modules/.vitest/.vitest-secret-token. This token is essential for authenticating requests between Vitest components and maintaining session integrity within the testing environment. By accessing this file, an attacker can potentially hijack sessions or manipulate test execution results if they have control over the client side interacting with these services. Furthermore, when Browser Mode is utilized in conjunction with multiple project configurations, the vulnerability extends to exposing JavaScript-compatible .env values through a malicious website. This occurs because the server may inadvertently serve environment variable files that contain sensitive credentials, database connection strings, or API keys intended for internal use only, thereby compromising the confidentiality of the application's configuration data.
The operational impact of this vulnerability is severe in development and continuous integration environments where Vitest is commonly deployed. Since these servers are often exposed to local networks or even public internet-facing proxies during active testing phases, the risk of exploitation increases significantly. An adversary with access to the network segment hosting the Vitest server can craft specific HTTP requests that target the improperly filtered paths. The ability to read denied project files allows for further reconnaissance and potential code injection attacks if source code is exposed. Additionally, the exposure of environment variables poses a direct threat to application security, as these values often contain secrets required for external service integrations. If an attacker obtains these credentials, they can escalate their privileges within the broader infrastructure or exfiltrate sensitive data stored in connected databases and third-party services. This aligns with ATT&CK technique T1083, which involves File and Directory Discovery, as well as T1552, Unsecured Credentials, highlighting the dual nature of this flaw as both a discovery vector and an authentication bypass mechanism.
Mitigation for this vulnerability requires immediate upgrading to Vitest version 5.0.5 or later, where the developers have corrected the order of operations in the server initialization process to ensure that all deny rules are applied before any file access is permitted. In environments where upgrading is not immediately feasible, administrators should restrict network access to Vitest dev servers by configuring firewalls to allow connections only from trusted IP addresses and disabling public exposure entirely during development cycles. It is also advisable to audit project configurations to ensure that sensitive files such as .env or secret tokens are stored outside the web-accessible root directory whenever possible. Regular security audits of testing frameworks used in CI/CD pipelines should include checks for similar misconfigurations in file serving logic, ensuring that default deny policies are strictly enforced across all server components and endpoints.