9.8 CriticalCWE-22
CVE-2026-47429
Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
vitest-devvitest
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 24 Oct
0.9%probability of exploitation in the next 30 days
Higher than 59% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.
Coverage 1 article · 1 outlet
- Critical Vitest flaws expose dev setups to remote code executionSecurityOnline · first in our coverage · mentions it in passing