File Exposure Vulnerability in Vitest Testing Framework by Vitest Dev
CVE-2026-112948

6.5MEDIUM

Key Information:

Vendor

Vitest-dev

Status
Vitest
Browser
Ui
Vite-plus
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112948?

The Vitest testing framework, specifically versions from 5.0.0-beta.6 to 5.0.5, exhibits a configuration issue in its development servers. This vulnerability arises from the incorrect application of the server.fs.deny settings, allowing malicious actors to access restricted project files or sensitive fallback API tokens. If a user interacts with an exposed UI or an API server, they may inadvertently leak secure information, such as JavaScript-compatible environmental variables and the vulnerable .vitest-secret-token file, potentially compromising application security. This issue has been addressed and resolved in version 5.0.5.

Affected Version(s)

browser >= 5.0.0-beta.6, < 5.0.5

ui >= 5.0.0-beta.6, < 5.0.5

vite-plus >= 1.0.0-rc.0, < 1.3.0

References

https://github.com/vitest-dev/vitest/security/advisories/...
x_refsource_CONFIRM
https://github.com/vitest-dev/vitest/pull/11578
x_refsource_MISC
https://github.com/vitest-dev/vitest/commit/28dc1edfb6ba5...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.