vitest-dev vitest up to 4.1.10 Interceptor Plugin interceptorPlugin.ts load redirect/pathname

Summaryinfo

A vulnerability was found in vitest-dev vitest up to 4.1.10. It has been classified as problematic. Impacted is the function Load of the file packages/mocker/src/node/interceptorPlugin.ts of the component Interceptor Plugin. Performing a manipulation of the argument redirect/pathname results in redirect. This vulnerability is identified as CVE-2026-84373. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in vitest-dev vitest up to 4.1.10. It has been classified as problematic. This affects the function load of the file packages/mocker/src/node/interceptorPlugin.ts of the component Interceptor Plugin. The manipulation of the argument redirect/pathname with an unknown input leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on integrity. The summary by CVE is:

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-84373 since 09/01/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

Upgrading to version 4.1.11 or 5.0.0-rc.2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• vitest-dev

Name

• vitest

Version

• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.1.8
• 4.1.9
• 4.1.10

Website

• Product: https://github.com/vitest-dev/vitest/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion