CVE-2026-47429

MediumCVSS 5.9/10Last modified Oct 24, 2026

Description

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
vitest-dev	vitest	< 3.2.5; >= 4.0.0, < 4.1.0

References

https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8dPatch
https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8Patch
https://github.com/vitest-dev/vitest/pull/10445Exploit, Issue Tracking, Patch
https://github.com/vitest-dev/vitest/pull/9350Exploit, Issue Tracking, Patch
https://github.com/vitest-dev/vitest/releases/tag/v3.2.5Release Notes
https://github.com/vitest-dev/vitest/releases/tag/v4.1.0Release Notes
https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwpExploit, Mitigation, Vendor Advisory
https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwpExploit, Mitigation, Vendor Advisory

Timeline

Published: Jul 14, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-47435.2NULL Pointer Dereference vulnerability in taurusxin ncmdump (‎src/utils‎ modules). This vulnerability is associated with program files cJSON CVE-2026-474307.5## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate CVE-2026-47449.3Out-of-bounds Read vulnerability in rizonesoft Notepad3 (‎scintilla/oniguruma/src modules). This vulnerability is associated with program fi CVE-2026-474510.0Improper Control of Generation of Code ('Code Injection') vulnerability in dendibakh perf-ninja (labs/misc/pgo/lua modules). This vulnerabil CVE-2026-474610.0Out-of-bounds Write vulnerability in timeplus-io proton (base/poco/Foundation/src‎ modules). This vulnerability is associated with program f CVE-2026-47478.8Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet i CVE-2026-474706.2NVIDIA TensorRT-LLM for any platform contains a vulnerability in the gRPC server chat API endpoint, where an attacker could cause CWE-20 by CVE-2026-474717.5NVIDIA TensorRT-LLM for any platform contains a vulnerability in tensor deserialization, where an attacker could cause a heap based buffer o CVE-2026-474727.8NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could ca CVE-2026-474737.4NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a write-what-where condition. A successful exploit of this vulner CVE-2026-474756.2NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where an attacker could trigger a reachable assertion in CVE-2026-474767.5NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. A successfu