Remote File Disclosure Vulnerability in Vitest Testing Framework by Vitest
CVE-2026-84373
What is CVE-2026-84373?
The Vitest testing framework, versions 2.1.0 through 4.1.11 and 5.0.0-rc.2, suffers from a vulnerability that allows remote clients to exploit unauthenticated WebSocket connections. The mockerPlugin and interceptorPlugin frameworks do not properly validate redirect targets, enabling attackers to manipulate URL schemes. This vulnerability permits unauthorized access to local files, as the server's file-serving allowlist is not enforced, potentially causing severe security breaches. Although the browser mode of Vitest is token-authenticated by default, similar boundary checks are missing. The issue has been addressed in subsequent releases, ensuring better security hygiene for developers using Vitest.
Affected Version(s)
mocker >= 2.1.0, < 4.1.11 < 2.1.0, 4.1.11
mocker >= 5.0.0-beta.1, < 5.0.0-rc.2 < 5.0.0-beta.1, 5.0.0-rc.2
vitest >= 2.1.0, < 4.1.11 < 2.1.0, 4.1.11