CVE-2026-112950: @vitest/mocker Windows Backslash Traversal Vulnerability
Summary
CVE-2026-112950: Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix. Affects @vitest/mocker across 2 version ranges.
>= 4.1.11, < 4.1.12
>= 5.0.0-rc.2, < 5.0.3
Fixed in 4.1.12 or 5.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vitest is a testing framework designed for modern JavaScript applications, providing a fast and efficient way to run tests. The @vitest/mocker package allows developers to create mock implementations for testing purposes. However, a vulnerability exists that allows attackers to bypass security measures on Windows systems, potentially leading to unauthorized file access.
Vulnerability Detail
The vulnerability arises from a flaw in the path traversal fix implemented in the @vitest/mocker package. Specifically, the code incorrectly handles backslashes in redirect URLs on Windows systems. When an attacker crafts a URL with a backslash, such as 'C:/project/root/..\secret.txt', the path traversal check fails to reject it, allowing access to files outside the intended directory. This can lead to unauthorized reading of sensitive files, posing a significant security risk.
How To Fix
Latest published version: 5.0.5 as of 22 Oct 2026
npm install @vitest/mocker@5.0.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.1.11, < 4.1.124.1.12npm install @vitest/mocker@4.1.12 -
>= 5.0.0-rc.2, < 5.0.35.0.3npm install @vitest/mocker@5.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that your application does not expose the @vitest/mocker plugin to untrusted clients, especially on Windows systems. Additionally, you can manually validate and sanitize input paths to prevent unauthorized access.
Conclusion
The CVE-2026-112950 vulnerability in the @vitest/mocker package poses a significant risk for applications running on Windows systems due to improper handling of backslashes in URL paths. Updating to the patched version is crucial to mitigate this risk and protect sensitive files from unauthorized access.
See every vulnerability recorded for @vitest/mocker →
FAQ
CVE-2026-112950 is a vulnerability in the @vitest/mocker package that allows path traversal attacks on Windows systems, enabling unauthorized file access.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
Affected versions include @vitest/mocker 4.1.11 and versions from 5.0.0-rc.2 to 5.0.2. The vulnerability has been fixed in version 5.0.3 and 4.1.12.
If you cannot update immediately, consider restricting access to the @vitest/mocker plugin and validating input paths to mitigate the risk of exploitation.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @vitest/mocker.
