CVE-2026-112948
Received Received - Intake

Vitest Misapplies fs.deny Leading to File Exposure

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112948
EUVD
EUVD-2026-105143

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
vitest-dev vitest >= 5.0.0-beta.6, < 5.0.5
@vitest browser >= 5.0.0-beta.6, < 5.0.5
@vitest ui >= 5.0.0-beta.6, < 5.0.5
vitejs vite-plus >= 1.0.0-rc.0, < 1.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-552 The product makes files or directories accessible to unauthorized actors, even though they should not be.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Vitest versions 5.0.0-beta.6 to 5.0.5. It involves misapplication of file system access restrictions where Vitest incorrectly allows access to sensitive files despite deny list configurations. The issue occurs because Vitest adds an API token file to the deny list but fails to preserve Vite's default deny list, allowing unintended file access.

Detection Guidance

Check Vitest version with npm list vitest or yarn list vitest. If version is between 5.0.0-beta.6 and 5.0.5, the system is vulnerable. Inspect server.fs.deny configuration in Vitest config files for missing default deny list entries like .env, *.pem, or .git.

Impact Analysis

Attackers with network access to affected Vitest servers (UI, Browser Mode, or API) can read sensitive files like .env, private keys, .git directories, or the Vitest API token file (.vitest-secret-token). In Browser Mode with multiple test projects, a malicious website could also read .env values through the browser if they contain JavaScript-compatible data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data such as environment variables (.env), private keys, or configuration files, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Exposure of such data may result in compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Vitest to version 5.0.5 or later. If upgrading is not possible, explicitly set server.fs.deny in Vitest config to include Vite's default deny list and the token file .vitest-secret-token.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112948. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart