High [CVE-2026-47429] Arbitrary code execution and information disclosure via path traversal
This high-severity Red Hat Linux advisory covers CVE-2026-47429 affecting Red Hat Hardened Images.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution.
This issue is fixed in versions 3.2.5 and 4.1.0. Additionally, exposed API features could be exploited to execute arbitrary scripts, leading to potential system compromise.
Vitest ships a UI and API server (enabled via the --ui or --api flags, or automatically as part of Browser Mode) that exposes file read, file write, and test-rerun functionality over HTTP.
Due to an incorrect path-traversal check in the /__vitest_attachment__ handler and related code paths, a remote attacker who can reach this server can read arbitrary files, and via the write/rerun features can achieve arbitrary code execution.
Exploitation requires either exposing the server to a network host (--api.host / api.host config) or running the UI/Browser Mode on Windows. Red Hat's shipped products use vitest exclusively as a development-time unit test runner (invoked as `vitest run`, `test:unit`, or `--project` in CI/build pipelines).
Affected product named by the advisory: Red Hat Hardened Images.
- < 3.2.5
- < 4.1.0
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
- 3.2.5
- 4.1.0
- prometheus3-13-main-3.13.1-0.1.hum1
- RHSA-2026:39058
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
Mitigation checklist
- No mitigation is required for Red Hat products, as none run Vitest's UI/API server or Browser Mode in their build or shipped runtime. Developers who run `vitest --ui`, `vitest --api`, or Browser Mode interactively should avoid binding the server to a non-localhost host, and should upgrade to vitest >= 4.1.0 (or >= 3.2.5 on the 3.x branch), where the allowWrite/allowExec flags default to disabled whenever the server is bound to a non-localhost host.
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.