Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.

Summary @vitest/mocker registers a redirect mock's target path without validating it against the dev server's file-serving allowlist. An attacker who can reach the dev server's WebSocket can register a redirect mock pointing outside the project root; when the mocked module is requested, the plugin's load hook returns readFile(<attacker path>) as the module source, disclosing local files.

This is exploitable without authentication only through the public mockerPlugin / standalone interceptorPlugin exports (used by third-party dev servers), which register the handler on Vite's unauthenticated HMR socket. Vitest's own browser mode registers mocks over a token-authenticated RPC and is not remotely reachable by default (see Scope).

Affected code packages/mocker/src/node/interceptorPlugin.ts.

The load hook is the file-read sink:

ts if (mock.type === 'redirect') { return readFile(mock.redirect, 'utf-8') }

mock.redirect is derived from client input at registration time with no boundary check:

ts if (event.type === 'redirect') { const redirectUrl = new URL(event.redirect) event.redirect = join(server.config.root, redirectUrl.pathname) } registry.register(event)

There is no server.fs.allow / server.fs.deny check and no assertion that the resolved path stays within the project root.

Registration paths and trust boundaries - Public mockerPlugin / interceptorPlugin (unauthenticated). In configureServer, the plugin registers server.ws.on('vitest:interceptor:register', …) on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin check, so any client that can reach it can register a redirect mock. This is the path the "unauthenticated" impact applies to. - Vitest browser mode (authenticated). Mocks register over the browser RPC (registerMock), which sits behind a per-run token (isValidApiRequest, a random api.token). The interceptor's configureServer socket is not used for registration here (in v5 it does not run at all, as the plugin is injected per environment). The same missing boundary check exists on the authenticated RPC path, but reaching it requires the token, so it is not a remote-unauthenticated read.

Path handling new URL(redirect).pathname combined with join(root, pathname) does not confine reads to the root:

- Special/hierarchical schemes (file:, http:) are normalized by WHATWG URL, so .. segments are collapsed and the result stays under the root. Payloads of the form file:///../../etc/passwd do not escape. - A non-special (opaque) scheme preserves .. in pathname, so join(root, "../../…/etc/passwd") resolves outside the root and reads an arbitrary file.

Even without escaping the root, the missing server.fs check allows reading any in-root file the dev server would otherwise refuse to serve (for example an in-root .env or source that is denied by server.fs.deny).

Scope / preconditions - This is a development-server issue. The dev server binds to localhost by default and is not reachable from the network unless the developer exposes it (server.host / 0.0.0.0, a LAN bind, or a proxy). - A raw (non-browser) client against a reachable server bypasses browser origin and CORS protections entirely and can both register the mock and read the response. - A browser-based drive-by against a localhost server is substantially mitigated by Vite defaults: the default CORS origin allowlist is limited to localhost origins, and server.allowedHosts blocks DNS-rebinding, so a cross-origin page cannot read the file contents back.

Impact Disclosure of local files readable by the dev-server process (source, in-root .env/secrets, and, via the opaque-scheme payload, files outside the project root). No integrity or availability impact.

Affected versions Present since @vitest/mocker was introduced.

- Affected: @vitest/mocker >= 2.1.0 (shipped in vitest and @vitest/browser >= 2.1.0), through 4.1.x and the 5.0.0 pre-releases. - Fixed: Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not maintained and are not planned to receive the fix.

Fix Validate the resolved redirect target against Vite's file-serving allowlist (isFileLoadingAllowed) before registering it, at every registration site, and stop registering the interceptor WebSocket events in Vitest's browser mode (mocks there flow through the authenticated RPC).

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWrite permission gate or confining paths to the project root. A client that can reach the Browser Mode API can read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process even when allowWrite is false. This issue is fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6.