CVE-2026-47429

High [CVE-2026-47429] Arbitrary code execution and information disclosure via path traversal

CVE-2026-47429Source published Jul 14, 2026Source updated Jul 14, 2026

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0. Additionally, exposed API features could be exploited to execute arbitrary scripts, leading to potential system compromise. Vitest ships a UI and API server (enabled via the --ui or --api flags, or automatically as part of Browser Mode) that exposes file read, file write, and test-rerun functionality over HTTP. Due to an incorrect path-traversal check in the /__vitest_attachment__ handler…

Affected products in this advisory

• Red Hat Hardened Images

Source-reported affected versions

• < 3.2.5
• < 4.1.0

Source-reported fixed versions

• 3.2.5
• 4.1.0
• prometheus3-13-main-3.13.1-0.1.hum1
• RHSA-2026:39058

Mitigation guidance

• No mitigation is required for Red Hat products, as none run Vitest's UI/API server or Browser Mode in their build or shipped runtime. Developers who run `vitest --ui`, `vitest --api`, or Browser Mode interactively should avoid binding the server to a non-localhost host, and should upgrade to vitest >= 4.1.0 (or >= 3.2.5 on the 3.x branch), where the allowWrite/allowExec flags default to disabled whenever the server is bound to a non-localhost host.