CVE-2026-47429: Vitest.dev Vitest

Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days.

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

Affected products

• Vitest.dev Vitest: before 3.2.5 (fixed in 3.2.5); from 4.0.0, before 4.1.0 (fixed in 4.1.0)

Published 2026-07-14. Last modified 2026-08-06.