CVE-2026-112948: falha de média gravidade em vitest-dev vitest
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.4%
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVEs relacionadas — vitest-dev vitest
No mesmo produto, das mais perigosas para as menos.
CVE-2026-39363HIGHVite Affected by Arbitrary File Read via Vite Dev Server WebSocketEPSS 3.4%CVE-2026-39364HIGHVite has a `server.fs.deny` bypass with queriesEPSS 2.3%CVE-2026-112942HIGHlaunch-editor: `fs.existsSync()` existence check can be bypassed on WindowsEPSS 1.3%CVE-2026-39365MEDIUMVite has a Path Traversal in Optimized Deps `.map` HandlingEPSS 0.9%CVE-2026-112946MEDIUMVite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machineEPSS 0.9%CVE-2026-112944MEDIUMlaunch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorsEPSS 0.7%