CVE-2026-47429

Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in Vitest via UI/API Server on Windows

Publication date: 2026-07-14

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-21

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-47429

Affected Vendors & Products

Vendor	Product	Version / Range
vitest	vitest	to 3.2.5\|end_excluding=4.1.0 (exc)
vitest-dev	vitest	to 3.2.5 (exc)
vitest-dev	vitest	to 4.1.0 (exc)
vitest-dev	vitest	From 3.2.5 (inc) to 4.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-47429 is a critical vulnerability in Vitest, a testing framework. It allows path traversal and arbitrary file read/write/execution when the Vitest UI/API server is exposed on Windows systems. The issue stems from incorrect handling of the isFileServingAllowed function, enabling bypasses like \?\..\ to access files outside the project directory. The API's rerun and file write features could also execute malicious scripts.

Detection Guidance

Check Vitest version with npm list vitest or npx vitest --version. If using Windows and Vitest UI/API server is exposed, verify if api.host is set to localhost or 127.0.0.1. Inspect network exposure by checking if the Vitest server port is accessible externally.

Impact Analysis

If you use Vitest versions before 3.2.5 or 4.1.0 and expose the UI/API server to a network, attackers could read sensitive files, modify or delete files, or execute arbitrary code on your system. This is especially dangerous if the server runs on Windows or handles untrusted inputs.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Unauthorized file reads/writes may result in data breaches, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Upgrade Vitest to version 3.2.5, 3.2.6, or 4.1.0 or later. Ensure api.host is set to localhost or 127.0.0.1. If API must be exposed, explicitly disable allowWrite and allowExec in API configuration. Avoid exposing Vitest UI/API server to untrusted networks.

Hi! I’m here to help you understand CVE-2026-47429. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70