Açıklama
The path traversal fix in @vitest/mocker (GHSA-82fw-gwwq-j7x9) could be bypassed on Windows. Redirect registration joined the client-supplied path with the Vite root using POSIX rules, so a ..\ segment passed the server.fs.allow check, while the later file read treated the backslash as a separator. A client that can reach the Vite dev server could register a redirect mock and read files outside the allowed root. Fixed in 4.1.12 and 5.0.3.
CVSS Vektörü
Birincil değerlendirmeGitHub CNA · 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NAV: Ağ (Network)AC: Yüksek (High)PR: Yok (None)UI: Yok (None)S: Değişmez (Unchanged)C: Yüksek (High)I: Yok (None)A: Yok (None)
Bildirim Durumu
- Etkilenen sürümler
- @vitest/mocker 4.1.11 and >= 5.0.0-rc.2, < 5.0.3
- Yama durumu
- Fixed in 4.1.12 and 5.0.3
- Üretici yanıtı
- Maintainers published GHSA-xp26-3454-mjgp and released fixed versions
- Birincil puan kaynağı
- GitHub CNA
Referanslar
- CVE.org Kaydı
- GitHub Security Advisory GHSA-xp26-3454-mjgp
- Original advisory GHSA-82fw-gwwq-j7x9 (the bypassed fix)
- Fix commit 15cc006 (PR #11377)
- Backport commit b825313 (PR #11580)
- Vitest 5.0.3 release
- Vitest 4.1.12 release
- NVD — Ulusal Zafiyet Veritabanı
- MITRE CVE Girişi
Kayıt Doğrulama
KrediGitHub advisory GHSA-xp26-3454-mjgp, bildiren olarak Sevban DÖNMEZ (jankesec) adını belirtir
YayınlanmaCVE kaydı 2026-10-20 tarihinde yayınlandı
KontrolMetaveriler son olarak 2026-10-30 tarihinde CVE Services kaydıyla doğrulandı
Bildirim Zaman Çizelgesi
2026-09-28Fix merged — The fix referenced by the advisory landed in vitest-dev/vitest (PR #11377). Kaynak ↗
2026-10-14Backport — The redirect mock hardening was backported to the 4.x line (PR #11580). Kaynak ↗
2026-10-20Published — GitHub, as CNA, published the CVE record and advisory GHSA-xp26-3454-mjgp. Kaynak ↗
2026-10-28Record update — CISA added its Vulnrichment (SSVC) assessment to the CVE record.
2026-10-30Site verification — jankesec checked the CVE record, score, affected versions, and references.