CVE-2026-112948: medium-severity vulnerability in vitest-dev vitest
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.4%
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Related CVEs — vitest-dev vitest
In the same product, most dangerous first.
CVE-2026-39363HIGHVite Affected by Arbitrary File Read via Vite Dev Server WebSocketEPSS 3.4%CVE-2026-39364HIGHVite has a `server.fs.deny` bypass with queriesEPSS 2.3%CVE-2026-112942HIGHlaunch-editor: `fs.existsSync()` existence check can be bypassed on WindowsEPSS 1.3%CVE-2026-39365MEDIUMVite has a Path Traversal in Optimized Deps `.map` HandlingEPSS 0.9%CVE-2026-112946MEDIUMVite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machineEPSS 0.9%CVE-2026-112944MEDIUMlaunch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorsEPSS 0.7%