Security Advisory

CVE-2026-47429

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-14 19:28:08

Last updated 2026-07-21 15:02:17

Assigner GitHub_M

CVSS score 9.8

State PUBLISHED

Description

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

← Browse all CVEs View on cve.org ↗