Backslash Traversal Vulnerability in Vitest Testing Framework by Vitest Dev
CVE-2026-112950
5.9MEDIUM
What is CVE-2026-112950?
A vulnerability in the Vitest testing framework allows attackers to exploit the filesystem read functionality on Windows. Versions 4.1.11, 4.1.12, and 5.0.3 are affected by misinterpretation of backslashes, enabling backslash traversal when registering redirect mocks. This flaw allows clients to access files outside the permitted directories configured in the Vitest process. The issue has been rectified in Vitest versions 4.1.12 and 5.0.3, which users are encouraged to upgrade to for enhanced security.
Affected Version(s)
mocker >= 4.1.11, < 4.1.12 < 4.1.11, 4.1.12
mocker >= 5.0.0-rc.2, < 5.0.3 < 5.0.0-rc.2, 5.0.3
vitest >= 4.1.11, < 4.1.12 < 4.1.11, 4.1.12