CVE-2026-112950: Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vitestto a version that resolves this vulnerability.Fixed in 4.1.12 - Upgrade
Upgrade
Vitestto a version that resolves this vulnerability.Fixed in 5.0.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Vitest running on Windows when a client can reach the Vite development server. The vulnerable behavior can expose files outside server.fs.allow that are readable by the Vitest process.
What does an attacker need to exploit it?
An unauthenticated client must be able to reach the Vite dev server and register a redirect mock containing backslash traversal. Exploitation also depends on the target file being accessible to the Vitest process.
Are all affected-version installations vulnerable by default?
The provided information identifies Windows deployments with reachable Vite dev servers as the relevant exposure condition. It does not establish whether the server is reachable by default or whether redirect mock registration is enabled in every configuration.
What versions contain the fix?
The issue is fixed in Vitest 4.1.12 and 5.0.3. Versions from 4.1.11 up to, but excluding, those fixed releases are affected according to the advisory.