CVE-2026-47429 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
Attackers can read arbitrary files and execute scripts via path traversal in the Vitest UI server on Windows when the server is active.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47429?
CVE-2026-47429 is a critical path traversal vulnerability in vitest-dev vitest, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-47429?
4 open source packages ship an affected version, including vitest. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vitest npm | All versions | 3.2.6 |
vitest npm | All versions | 3.2.6 |
vitest npm | From 4.0.0 | 4.1.0 |
vitest npm | From 4.0.0 | 4.1.0 |
Products include Vitest.dev Vitest.
How do I fix CVE-2026-47429?
Upgrade vitest to a fixed version for your release line: 3.2.6 or 4.1.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-47429 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47429 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in vitest-dev vitest
Sources
Also known as GHSA-5xrq-8626-4rwp, MINI-46v9-5hx4-wh5v, MINI-543j-26p3-xqcx, MINI-69gr-x579-2vc3, MINI-g954-c4jp-4wxv, MINI-jr9p-322p-258c and 4 more.