Vitest <3.2.5/<4.1.0 Arbitrary File Read/Execution Vulnerability (CVE-2025-47429)

Vulnerability Overview Title: Arbitrary Files Can Be Read and Executed When the Vitest UI Server Is Listening Description: On Windows, when the Vitest UI server is listening—especially if exposed to the network—arbitrary files can be read. Affected Versions Affected Versions: - >=4.0.0, <4.1.0 - <3.2.5 Fixed Versions: - 4.1.0 - 3.2.5 Conditions of Impact: - The Vitest UI server is explicitly exposed to the network (using or configuration options) - Running the Vitest UI or Browser Mode on Windows Mitigation Mitigations: - Vitest now provides two configuration flags, and , to control privileged operations. - By default, both flags are disabled regardless of which host the API server binds to, ensuring that servers exposed to the network no longer implicitly grant remote clients the ability to read, write, or execute files. - When these flags are disabled, the UI enters read-only mode, disabling code editing and test file execution in Browser Mode, thereby reducing the attack surface for remote code execution. Many Browser Mode features are also disabled, such as attachments, artifacts, and snapshots. - Users who require the full interactive UI on network-facing hosts must explicitly set and/or to . POC Code Additional Information CVSS v3 Base Metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: None - User interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2025-47429 Weaknesses: No CWEs Credits: - Reporter: sapphi-red Summary This vulnerability allows for the reading and execution of arbitrary files under specific conditions, primarily affecting Windows users. The mitigation involves disabling privileged operations and entering a read-only mode to prevent remote code execution.

Goal Reached Thanks to every supporter — we hit 100%!

Vitest <3.2.5/<4.1.0 Arbitrary File Read/Execution Vulnerability (CVE-2025-47429)

More from this source