Vulnerability-Lookup

GHSA-82FW-GWWQ-J7X9

Vulnerability from github – Published: 2026-09-08 20:46 – Updated: 2026-09-08 20:46

Summary

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Details

Summary

@vitest/mocker registers a redirect mock's target path without validating it against the dev server's file-serving allowlist. An attacker who can reach the dev server's WebSocket can register a redirect mock pointing outside the project root; when the mocked module is requested, the plugin's load hook returns readFile(<attacker path>) as the module source, disclosing local files.

This is exploitable without authentication only through the public mockerPlugin / standalone interceptorPlugin exports (used by third-party dev servers), which register the handler on Vite's unauthenticated HMR socket. Vitest's own browser mode registers mocks over a token-authenticated RPC and is not remotely reachable by default (see Scope).

Affected code

packages/mocker/src/node/interceptorPlugin.ts.

The load hook is the file-read sink:

if (mock.type === 'redirect') {
  return readFile(mock.redirect, 'utf-8')
}

mock.redirect is derived from client input at registration time with no boundary check:

if (event.type === 'redirect') {
  const redirectUrl = new URL(event.redirect)
  event.redirect = join(server.config.root, redirectUrl.pathname)
}
registry.register(event)

There is no server.fs.allow / server.fs.deny check and no assertion that the resolved path stays within the project root.

Registration paths and trust boundaries

Public mockerPlugin / interceptorPlugin (unauthenticated). In configureServer, the plugin registers server.ws.on('vitest:interceptor:register', …) on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin check, so any client that can reach it can register a redirect mock. This is the path the "unauthenticated" impact applies to.
Vitest browser mode (authenticated). Mocks register over the browser RPC (registerMock), which sits behind a per-run token (isValidApiRequest, a random api.token). The interceptor's configureServer socket is not used for registration here (in v5 it does not run at all, as the plugin is injected per environment). The same missing boundary check exists on the authenticated RPC path, but reaching it requires the token, so it is not a remote-unauthenticated read.

Path handling

new URL(redirect).pathname combined with join(root, pathname) does not confine reads to the root:

Special/hierarchical schemes (file:, http:) are normalized by WHATWG URL, so .. segments are collapsed and the result stays under the root. Payloads of the form file:///../../etc/passwd do not escape.
A non-special (opaque) scheme preserves .. in pathname, so join(root, "../../…/etc/passwd") resolves outside the root and reads an arbitrary file.

Even without escaping the root, the missing server.fs check allows reading any in-root file the dev server would otherwise refuse to serve (for example an in-root .env or source that is denied by server.fs.deny).

Scope / preconditions

This is a development-server issue. The dev server binds to localhost by default and is not reachable from the network unless the developer exposes it (server.host / 0.0.0.0, a LAN bind, or a proxy).
A raw (non-browser) client against a reachable server bypasses browser origin and CORS protections entirely and can both register the mock and read the response.
A browser-based drive-by against a localhost server is substantially mitigated by Vite defaults: the default CORS origin allowlist is limited to localhost origins, and server.allowedHosts blocks DNS-rebinding, so a cross-origin page cannot read the file contents back.

Impact

Disclosure of local files readable by the dev-server process (source, in-root .env/secrets, and, via the opaque-scheme payload, files outside the project root). No integrity or availability impact.

Affected versions

Present since @vitest/mocker was introduced.

Affected: @vitest/mocker >= 2.1.0 (shipped in vitest and @vitest/browser >= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.
Fixed: Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not maintained and are not planned to receive the fix.

Fix

Validate the resolved redirect target against Vite's file-serving allowlist (isFileLoadingAllowed) before registering it, at every registration site, and stop registering the interceptor WebSocket events in Vitest's browser mode (mocks there flow through the authenticated RPC).

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@vitest/mocker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0"
            },
            {
              "fixed": "4.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vitest"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0"
            },
            {
              "fixed": "4.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vitest"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-beta.1"
            },
            {
              "fixed": "5.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@vitest/mocker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-beta.1"
            },
            {
              "fixed": "5.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-84373"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T20:46:45Z",
    "nvd_published_at": "2026-09-01T22:17:19Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n`@vitest/mocker` registers a redirect mock\u0027s target path without validating it\nagainst the dev server\u0027s file-serving allowlist. An attacker who can reach the\ndev server\u0027s WebSocket can register a redirect mock pointing outside the project\nroot; when the mocked module is requested, the plugin\u0027s `load` hook returns\n`readFile(\u003cattacker path\u003e)` as the module source, disclosing local files.\n\nThis is exploitable **without authentication** only through the public\n`mockerPlugin` / standalone `interceptorPlugin` exports (used by third-party dev\nservers), which register the handler on Vite\u0027s unauthenticated HMR socket.\nVitest\u0027s own browser mode registers mocks over a **token-authenticated** RPC and\nis not remotely reachable by default (see Scope).\n\n## Affected code\n`packages/mocker/src/node/interceptorPlugin.ts`.\n\nThe `load` hook is the file-read sink:\n\n```ts\nif (mock.type === \u0027redirect\u0027) {\n  return readFile(mock.redirect, \u0027utf-8\u0027)\n}\n```\n\n`mock.redirect` is derived from client input at registration time with no\nboundary check:\n\n```ts\nif (event.type === \u0027redirect\u0027) {\n  const redirectUrl = new URL(event.redirect)\n  event.redirect = join(server.config.root, redirectUrl.pathname)\n}\nregistry.register(event)\n```\n\nThere is no `server.fs.allow` / `server.fs.deny` check and no assertion that the\nresolved path stays within the project root.\n\n## Registration paths and trust boundaries\n- **Public `mockerPlugin` / `interceptorPlugin` (unauthenticated).** In\n  `configureServer`, the plugin registers `server.ws.on(\u0027vitest:interceptor:register\u0027, \u2026)`\n  on Vite\u0027s HMR WebSocket. That socket performs no token, Origin, or same-origin\n  check, so any client that can reach it can register a redirect mock. This is\n  the path the \"unauthenticated\" impact applies to.\n- **Vitest browser mode (authenticated).** Mocks register over the browser RPC\n  (`registerMock`), which sits behind a per-run token (`isValidApiRequest`, a\n  random `api.token`). The interceptor\u0027s `configureServer` socket is not used for\n  registration here (in v5 it does not run at all, as the plugin is injected per\n  environment). The same missing boundary check exists on the authenticated RPC\n  path, but reaching it requires the token, so it is not a remote-unauthenticated\n  read.\n\n## Path handling\n`new URL(redirect).pathname` combined with `join(root, pathname)` does **not**\nconfine reads to the root:\n\n- Special/hierarchical schemes (`file:`, `http:`) are normalized by WHATWG URL,\n  so `..` segments are collapsed and the result stays under the root. Payloads of\n  the form `file:///../../etc/passwd` do **not** escape.\n- A non-special (opaque) scheme preserves `..` in `pathname`, so\n  `join(root, \"../../\u2026/etc/passwd\")` resolves outside the root and reads an\n  arbitrary file.\n\nEven without escaping the root, the missing `server.fs` check allows reading any\nin-root file the dev server would otherwise refuse to serve (for example an\nin-root `.env` or source that is denied by `server.fs.deny`).\n\n## Scope / preconditions\n- This is a **development-server** issue. The dev server binds to `localhost` by\n  default and is not reachable from the network unless the developer exposes it\n  (`server.host` / `0.0.0.0`, a LAN bind, or a proxy).\n- A raw (non-browser) client against a reachable server bypasses browser origin\n  and CORS protections entirely and can both register the mock and read the\n  response.\n- A browser-based drive-by against a localhost server is substantially mitigated\n  by Vite defaults: the default CORS origin allowlist is limited to `localhost`\n  origins, and `server.allowedHosts` blocks DNS-rebinding, so a cross-origin page\n  cannot read the file contents back.\n\n## Impact\nDisclosure of local files readable by the dev-server process (source, in-root\n`.env`/secrets, and, via the opaque-scheme payload, files outside the project\nroot). No integrity or availability impact.\n\n## Affected versions\nPresent since `@vitest/mocker` was introduced.\n\n- **Affected: `@vitest/mocker` \u003e= 2.1.0** (shipped in `vitest` and\n  `@vitest/browser` \u003e= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.\n- **Fixed:** Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not\n  maintained and are not planned to receive the fix.\n\n## Fix\nValidate the resolved redirect target against Vite\u0027s file-serving allowlist\n(`isFileLoadingAllowed`) before registering it, at every registration site, and\nstop registering the interceptor WebSocket events in Vitest\u0027s browser mode\n(mocks there flow through the authenticated RPC).",
  "id": "GHSA-82fw-gwwq-j7x9",
  "modified": "2026-09-08T20:46:45Z",
  "published": "2026-09-08T20:46:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84373"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/pull/10972"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/pull/10974"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vitest-dev/vitest"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock"
}

CVE-2026-84373 (GCVE-0-2026-84373)

Vulnerability from cvelistv5 – Published: 2026-09-01 21:26 – Updated: 2026-09-02 13:22

Title

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Summary

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 13:20 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

8 references

URL	Tags
https://github.com/vitest-dev/vitest/security/adv…	x_refsource_CONFIRM
https://github.com/vitest-dev/vitest/pull/10972	x_refsource_MISC
https://github.com/vitest-dev/vitest/pull/10974	x_refsource_MISC
https://github.com/vitest-dev/vitest/commit/51edf…	x_refsource_MISC
https://github.com/vitest-dev/vitest/commit/8ff9b…	x_refsource_MISC
https://github.com/vitest-dev/vitest/commit/fe5a1…	x_refsource_MISC
https://github.com/vitest-dev/vitest/releases/tag…	x_refsource_MISC
https://github.com/vitest-dev/vitest/releases/tag…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
vitest-dev	vitest	Affected: >= 2.1.0, < 4.1.11 Affected: >= 5.0.0-beta.1, < 5.0.0-rc.2
@vitest	mocker	Affected: >= 2.1.0, < 4.1.11 Affected: >= 5.0.0-beta.1, < 5.0.0-rc.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T13:20:05.845961Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T13:22:16.806Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vitest",
          "vendor": "vitest-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 4.1.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.1, \u003c 5.0.0-rc.2"
            }
          ]
        },
        {
          "product": "mocker",
          "vendor": "@vitest",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 4.1.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.1, \u003c 5.0.0-rc.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite\u0027s unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin\u0027s load hook then returns readFile(mock.redirect, \u0027utf-8\u0027) as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T21:26:26.110Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/pull/10972",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/pull/10972"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/pull/10974",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/pull/10974"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.11"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2"
        }
      ],
      "source": {
        "advisory": "GHSA-82fw-gwwq-j7x9",
        "discovery": "UNKNOWN"
      },
      "title": "Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-84373",
    "datePublished": "2026-09-01T21:26:26.110Z",
    "dateReserved": "2026-09-01T16:27:58.129Z",
    "dateUpdated": "2026-09-02T13:22:16.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-82FW-GWWQ-J7X9

Summary

Affected code

Registration paths and trust boundaries

Path handling

Scope / preconditions

Impact

Affected versions

Fix

CVE-2026-84373 (GCVE-0-2026-84373)

Tags

Sightings

Nomenclature

Related by attack behaviour