CVE-2026-112950 · GHSA-xp26-3454-mjgp
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
- Risk score
- 47/100
- CVSS
- 5.9 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and re…
- Affected
- @vitest/mocker (npm) >= 4.1.11, < 4.1.12; @vitest/mocker (npm) >= 5.0.0-rc.2, < 5.0.3
- Fix
- Upgrade @vitest/mocker to 4.1.12 or 5.0.3 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
@vitest/mocker: Yellow, plan it in. Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and re…
The flaws
- CVE-2026-112950: Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix (CVSS 5.9 · EPSS 0%)
- CVE-2026-112949: Vitest: Code injection via unauthenticated manual mock registration (CVSS 4.7 · EPSS 0%)
The fix
Upgrade @vitest/mocker: 4.1.12 · 5.0.3 or later on your release line
Who is exposed: @vitest/mocker (npm) >= 4.1.11, < 4.1.12; @vitest/mocker (npm) >= 5.0.0-rc.2, < 5.0.3
Where it stands
- Public proof of concept
Connects to
- Same weakness: Path traversal (CWE-22). 399 other warnings in 30 days
Why it is Yellow
- CVSS 5.9 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @vitest/mocker | npm | >= 4.1.11, < 4.1.12 | 4.1.12 |
| @vitest/mocker | npm | >= 5.0.0-rc.2, < 5.0.3 | 5.0.3 |
References
- https://github.com/advisories/GHSA-xp26-3454-mjgp
- https://github.com/vitest-dev/vitest/security/advisories/GHSA-xp26-3454-mjgp
- https://nvd.nist.gov/vuln/detail/CVE-2026-112950
- https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35
- https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473
- https://github.com/vitest-dev/vitest/releases/tag/v4.1.12
- https://github.com/vitest-dev/vitest/releases/tag/v5.0.3
- https://github.com/advisories/GHSA-xp26-3454-mjgp
Original description
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.
Last activity 20 Oct 2026. Patch Forecast updates every hour.