CVE-2026-84373 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
Remote attackers can read arbitrary local files via path traversal in Vitest's mocker plugin when the development server is exposed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84373?
CVE-2026-84373 is a medium-severity path traversal vulnerability in @vitest mocker, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.
Weakness: CWE-22
Which versions are affected by CVE-2026-84373?
8 open source packages ship an affected version, including @vitest/mocker and vitest.
| Package | Affected | Fixed in |
|---|---|---|
@vitest/mocker npm | From 2.1.0 | 4.1.11 |
@vitest/mocker npm | From 2.1.0 | 4.1.11 |
@vitest/mocker npm | From 5.0.0-beta.1 | 5.0.0-rc.2 |
@vitest/mocker npm | From 5.0.0-beta.1 | 5.0.0-rc.2 |
vitest npm | From 2.1.0 | 4.1.11 |
vitest npm | From 2.1.0 | 4.1.11 |
2 more packages
vitest npm | From 5.0.0-beta.1 | 5.0.0-rc.2 |
vitest npm | From 5.0.0-beta.1 | 5.0.0-rc.2 |
How do I fix CVE-2026-84373?
Upgrade @vitest/mocker to a fixed version for your release line: 4.1.11 or 5.0.0-rc.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-84373 being exploited?
There is no known exploitation of CVE-2026-84373 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-BX79488, CLEANSTART-2026-MR36651, CLEANSTART-2026-RG48611, CLSA-2026-1789478968, CLSA-2026-1792160943, CLSA-2026-1792160957 and 17 more.