GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-84373

Vulnerability from fkie_nvd - Published: 2026-09-01 22:17 - Updated: 2026-09-02 14:17
Severity
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.
References
security-advisories@github.comhttps://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8
security-advisories@github.comhttps://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4
security-advisories@github.comhttps://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f
security-advisories@github.comhttps://github.com/vitest-dev/vitest/pull/10972
security-advisories@github.comhttps://github.com/vitest-dev/vitest/pull/10974
security-advisories@github.comhttps://github.com/vitest-dev/vitest/releases/tag/v4.1.11
security-advisories@github.comhttps://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2
security-advisories@github.comhttps://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "vitest",
          "vendor": "vitest-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 4.1.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.1, \u003c 5.0.0-rc.2"
            }
          ]
        },
        {
          "product": "mocker",
          "vendor": "@vitest",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 4.1.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.1, \u003c 5.0.0-rc.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite\u0027s unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin\u0027s load hook then returns readFile(mock.redirect, \u0027utf-8\u0027) as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2."
    }
  ],
  "id": "CVE-2026-84373",
  "lastModified": "2026-09-02T14:17:16.637",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-84373",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-02T13:20:05.845961Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-01T22:17:19.143",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/pull/10972"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/pull/10974"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.11"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.