CVE-2026-47429: Vitest Arbitrary File Read and Execute Vulnerability
Summary
CVE-2026-47429: When Vitest UI server is listening, arbitrary file can be read and executed. Affects vitest versions < 4.1.0. Fixed in 4.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vitest is a modern testing framework designed for JavaScript and TypeScript applications, providing a rich user interface for running tests and viewing results. It features capabilities such as file serving, API access, and browser mode for enhanced testing experiences. However, a critical vulnerability has been identified that allows arbitrary file access when the Vitest UI server is exposed to the network, particularly on Windows systems.
Vulnerability Detail
The vulnerability arises from the incorrect implementation of the 'isFileServingAllowed' function in the Vitest API handler for the '/vitest_attachment' endpoint. This flaw allows attackers to bypass file access restrictions using specific path manipulations, such as '\?\..\'. As a result, sensitive files outside the project directory can be read and executed. The vulnerability is particularly severe when the Vitest UI server is exposed to the network, as it permits unauthorized access to the file system and the execution of arbitrary scripts.
How To Fix
Latest published version: 5.0.5 as of 23 Oct 2026
npm install vitest@5.0.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.0
This is the first release that contains the fix.
npm install vitest@4.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, you can mitigate the risk by configuring the Vitest API with the following flags in your configuration file: 'allowWrite: false' and 'allowExec: false'. This will prevent remote clients from executing scripts or writing files, effectively putting the UI in read-only mode.
Conclusion
In summary, CVE-2026-47429 is a critical vulnerability in the Vitest framework that allows unauthorized file access and execution when the UI server is exposed to the network. Users are strongly advised to update to version 4.1.0 or later to mitigate this risk. If immediate updates are not feasible, applying the recommended configuration changes can help secure your application.
See every vulnerability recorded for vitest →
FAQ
CVE-2026-47429 is a critical vulnerability in the Vitest testing framework that allows arbitrary file read and execution when the Vitest UI server is exposed to the network on Windows systems.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors for open-source vulnerabilities using your package-lock.json file.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
If you cannot update Vitest, configure the API with 'allowWrite: false' and 'allowExec: false' to mitigate the risk until you can apply the update.
The vulnerability can lead to unauthorized access to sensitive files and the execution of arbitrary scripts, posing significant security risks to affected systems.
References
Related vulnerabilities
Recent vulnerabilities recorded for vitest.
