{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47429", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-19T19:37:43.527Z", "datePublished": "2026-07-14T19:28:08.688Z", "dateUpdated": "2026-07-14T19:28:08.688Z"}, "containers": {"cna": {"title": "Vitest: Arbitrary file can be read and executed when Vitest UI server is listening", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp"}, {"name": "https://github.com/vitest-dev/vitest/pull/10445", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/pull/10445"}, {"name": "https://github.com/vitest-dev/vitest/pull/9350", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/pull/9350"}, {"name": "https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d"}, {"name": "https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8"}, {"name": "https://github.com/vitest-dev/vitest/releases/tag/v3.2.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/releases/tag/v3.2.5"}, {"name": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.0"}], "affected": [{"vendor": "vitest-dev", "product": "vitest", "versions": [{"version": "< 3.2.5", "status": "affected"}, {"version": ">= 4.0.0, < 4.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T19:28:08.688Z"}, "descriptions": [{"lang": "en", "value": "Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\\\?\\\\..\\\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0."}], "source": {"advisory": "GHSA-5xrq-8626-4rwp", "discovery": "UNKNOWN"}}}}

{}

{}

{"affected_release": [{"advisory": "RHSA-2026:39058", "cpe": "cpe:/a:redhat:hummingbird:1", "impact": "critical", "package": "prometheus3-13-main-3.13.1-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-13T00:00:00Z"}], "bugzilla": {"description": "vitest: Vitest: Arbitrary code execution and information disclosure via path traversal", "id": "2500573", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500573"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-22", "details": ["Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\\\?\\\\..\\\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.", "A flaw was found in Vitest, a testing framework. On Windows, the Vitest UI/API server incorrectly handled file serving, which could allow an attacker to read sensitive files outside the project directory. Additionally, exposed API features could be exploited to execute arbitrary scripts, leading to potential system compromise."], "mitigation": {"lang": "en:us", "value": "No mitigation is required for Red Hat products, as none run Vitest's UI/API server or Browser Mode in their build or shipped runtime.\nDevelopers who run `vitest --ui`, `vitest --api`, or Browser Mode interactively should avoid binding the server to a non-localhost host, and should upgrade to vitest >= 4.1.0 (or >= 3.2.5 on the 3.x branch), where the allowWrite/allowExec flags default to disabled whenever the server is bound to a non-localhost host."}, "name": "CVE-2026-47429", "package_state": [{"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Not affected", "package_name": "vitest", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-26/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-27/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "automation-platform-ui", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "vitest", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Not affected", "package_name": "rh-podman-desktop.git", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "vitest", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "vitest", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift4/ose-agent-installer-ui-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-07-14T19:28:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-47429\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47429\nhttps://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d\nhttps://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8\nhttps://github.com/vitest-dev/vitest/pull/10445\nhttps://github.com/vitest-dev/vitest/pull/9350\nhttps://github.com/vitest-dev/vitest/releases/tag/v3.2.5\nhttps://github.com/vitest-dev/vitest/releases/tag/v4.1.0\nhttps://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp"], "statement": "Vitest ships a UI and API server (enabled via the --ui or --api flags, or automatically as part of Browser Mode) that exposes file read, file write, and test-rerun functionality over HTTP. Due to an incorrect path-traversal check in the /__vitest_attachment__ handler and related code paths, a remote attacker who can reach this server can read arbitrary files, and via the write/rerun features can achieve arbitrary code execution. Exploitation requires either exposing the server to a network host (--api.host / api.host config) or running the UI/Browser Mode on Windows.\nRed Hat's shipped products use vitest exclusively as a development-time unit test runner (invoked as `vitest run`, `test:unit`, or `--project` in CI/build pipelines). None of the Red Hat products that ship vitest start its UI server, API server, or Browser Mode as part of their build process or shipped runtime. The @vitest/browser package (required for Browser Mode) is not present in any Red Hat product's manifest. As a result, the vulnerable code path is not reachable in any Red Hat product covered by this flaw, and affects are set to NOTAFFECTED / Vulnerable Code not in Execute Path.", "threat_severity": "Important"}