Vulnerability intelligence

CVE-2026-47429

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

CVSS Score

—

Critical

EPSS — Exploit Probability

1.0%

Riskier than 60% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

unknown

Check vendor advisories

NVD entry

1 article across 1 outlet · first covered Jun 5, 2026 · latest Jun 5, 2026

Coverage timeline

Critical Vitest flaws expose dev setups to remote code execution
securityonline.info · Jun 5, 2026