Description
The path traversal fix in @vitest/mocker (GHSA-82fw-gwwq-j7x9) could be bypassed on Windows. Redirect registration joined the client-supplied path with the Vite root using POSIX rules, so a ..\ segment passed the server.fs.allow check, while the later file read treated the backslash as a separator. A client that can reach the Vite dev server could register a redirect mock and read files outside the allowed root. Fixed in 4.1.12 and 5.0.3.
CVSS Vector
Primary assessmentGitHub CNA · 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NAV: NetworkAC: HighPR: NoneUI: NoneS: UnchangedC: HighI: NoneA: None
Disclosure Status
- Affected
- @vitest/mocker 4.1.11 and >= 5.0.0-rc.2, < 5.0.3
- Patch status
- Fixed in 4.1.12 and 5.0.3
- Vendor response
- Maintainers published GHSA-xp26-3454-mjgp and released fixed versions
- Primary score source
- GitHub CNA
References
- CVE.org Record
- GitHub Security Advisory GHSA-xp26-3454-mjgp
- Original advisory GHSA-82fw-gwwq-j7x9 (the bypassed fix)
- Fix commit 15cc006 (PR #11377)
- Backport commit b825313 (PR #11580)
- Vitest 5.0.3 release
- Vitest 4.1.12 release
- NVD — National Vulnerability Database
- MITRE CVE Entry
Record Verification
CreditThe GitHub advisory GHSA-xp26-3454-mjgp credits Sevban DÖNMEZ (jankesec) as reporter
PublishedThe CVE record was published on 2026-10-20
CheckedMetadata last checked against the CVE Services record on 2026-10-30
Disclosure Timeline
2026-09-28Fix merged — The fix referenced by the advisory landed in vitest-dev/vitest (PR #11377). Source ↗
2026-10-14Backport — The redirect mock hardening was backported to the 4.x line (PR #11580). Source ↗
2026-10-20Published — GitHub, as CNA, published the CVE record and advisory GHSA-xp26-3454-mjgp. Source ↗
2026-10-28Record update — CISA added its Vulnrichment (SSVC) assessment to the CVE record.
2026-10-30Site verification — jankesec checked the CVE record, score, affected versions, and references.