CVE-2026-47429

Katalog CVE

CVSS 5.9 · Medium EPSS 0,88%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada vitest.dev vitest. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

6 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,88% peluang dieksploitasi; lebih tinggi dari 57,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp exploit · mitigasi · advisory vendor
• https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d patch
• https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8 patch
• https://github.com/vitest-dev/vitest/pull/10445 exploit · issue tracking · patch
• https://github.com/vitest-dev/vitest/pull/9350 exploit · issue tracking · patch
• https://github.com/vitest-dev/vitest/releases/tag/v3.2.5 release notes
• https://github.com/vitest-dev/vitest/releases/tag/v4.1.0 release notes