CVE-2026-112948: Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at nodemodules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vitestto a version that resolves this vulnerability.Fixed in 5.0.5
Event History
Frequently Asked Questions
Which deployments are exposed to remote attackers?
Affected Vitest UI, Browser Mode, and API servers are exposed when an attacker can reach them. Browser Mode using test.projects has an additional risk: a malicious website can expose JavaScript-compatible values from .env files.
What sensitive files could an attacker read?
An attacker may read project files that should be denied by server.fs.deny, including .env files, private keys, and .git content. They may also retrieve the fallback API token stored at node_modules/.vitest/.vitest-secret-token.
Which versions are affected and what version fixes the issue?
Vitest versions from 5.0.0-beta.6 through 5.0.5 are described as affected. The issue is fixed in version 5.0.5.