CVE-2026-112948: fallo de gravedad media en vitest-dev vitest
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.4%
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVEs relacionadas — vitest-dev vitest
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-39363HIGHVite Affected by Arbitrary File Read via Vite Dev Server WebSocketEPSS 3.4%CVE-2026-39364HIGHVite has a `server.fs.deny` bypass with queriesEPSS 2.3%CVE-2026-112942HIGHlaunch-editor: `fs.existsSync()` existence check can be bypassed on WindowsEPSS 1.3%CVE-2026-39365MEDIUMVite has a Path Traversal in Optimized Deps `.map` HandlingEPSS 0.9%CVE-2026-112946MEDIUMVite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machineEPSS 0.9%CVE-2026-112944MEDIUMlaunch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorsEPSS 0.7%