CVE-2026-112950 Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-112950?
CVE-2026-112950 is a medium-severity vulnerability in @vitest mocker, published on 20 Oct 2026.
Official description
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.
Weakness: CWE-22
Which versions are affected by CVE-2026-112950?
4 open source packages ship an affected version, including @vitest/mocker.
| Package | Affected | Fixed in |
|---|---|---|
@vitest/mocker npm | From 4.1.11 | 4.1.12 |
@vitest/mocker npm | From 4.1.11 | 4.1.12 |
@vitest/mocker npm | From 5.0.0-rc.2 | 5.0.3 |
@vitest/mocker npm | From 5.0.0-rc.2 | 5.0.3 |
How do I fix CVE-2026-112950?
Upgrade @vitest/mocker to a fixed version for your release line: 4.1.12 or 5.0.3.
Is CVE-2026-112950 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-112950 exists.
Sources
Also known as CLSA-2026-1792617972, GHSA-xp26-3454-mjgp.