Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112948— Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

Quick assessment

Affected
vitest-dev vitest
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Vitest 是一个由 Vite 驱动的测试框架。在从 5.0.0-beta.6 到 5.0.5 的版本中，Vitest 的开发服务器可能错误地应用了 配置，因为项目服务器会覆盖 Vite 的默认设置，而根服务器在 Vite 完成其匹配器编译后才会添加 。能够访问受影响的前端界面（UI）、浏览器模式（Browser Mode）或 API 服务器的攻击者，可以读取被禁止访问的项目文件，或读取位于 中的备用 API 令牌。此外，若启用 的浏览器模式，攻击者还可通过恶意网站暴露兼容 JavaScript 的 环境变量值。

CVSS 6.5 · Medium

Affected Version Matrix 4

VendorProduct Version RangeStatus
@vitest browser >= 5.0.0-beta.6, < 5.0.5 affected
@vitest ui >= 5.0.0-beta.6, < 5.0.5 affected
vitejs vite-plus >= 1.0.0-rc.0, < 1.3.0 affected
vitest-dev vitest >= 5.0.0-beta.6, < 5.0.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112948

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Source: CVE Program / CVE List V5
Vulnerability Description
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vitest-dev vitest >= 5.0.0-beta.6, < 5.0.5 -
@vitest browser >= 5.0.0-beta.6, < 5.0.5 -
@vitest ui >= 5.0.0-beta.6, < 5.0.5 -
vitejs vite-plus >= 1.0.0-rc.0, < 1.3.0 -

II. Public POCs for CVE-2026-112948

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112948

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112948 (2)

Vendor Advisories for CVE-2026-112948 (1)

Vendor Pages for CVE-2026-112948 (1)

Same Patch Batch · vitest-dev · 2026-10-20 · 3 CVEs total

CVE-2026-112950 5.9 MEDIUM Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
CVE-2026-112949 4.7 MEDIUM Vitest: Code injection via unauthenticated manual mock registration

IV. Related Vulnerabilities

Same product: vitest
Same vendor: vitest-dev
Same weakness: CWE-200

V. Comments for CVE-2026-112948

No comments yet

Leave a comment