Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for browser by @vitest

    CVE-2026-112948 (GCVE-0-2026-112948)

    Vulnerability from nvd – Published: 2026-10-20 15:15 – Updated: 2026-10-20 16:16
    VLAI
    Title
    Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
    Summary
    Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-20 16:16 UTC
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    • CWE-552 - Files or Directories Accessible to External Parties
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7806 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    vitest-dev vitest Affected: >= 5.0.0-beta.6, < 5.0.5
    		Create a notification for this product.
    @vitest browser Affected: >= 5.0.0-beta.6, < 5.0.5
    		Create a notification for this product.
    @vitest ui Affected: >= 5.0.0-beta.6, < 5.0.5
    		Create a notification for this product.
    vitejs vite-plus Affected: >= 1.0.0-rc.0, < 1.3.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112948",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T16:16:51.150771Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T16:16:59.623Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vitest",
          "vendor": "vitest-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.6, \u003c 5.0.5"
            }
          ]
        },
        {
          "product": "browser",
          "vendor": "@vitest",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.6, \u003c 5.0.5"
            }
          ]
        },
        {
          "product": "ui",
          "vendor": "@vitest",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.6, \u003c 5.0.5"
            }
          ]
        },
        {
          "product": "vite-plus",
          "vendor": "vitejs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0-rc.0, \u003c 1.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite\u0027s defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "CWE-552: Files or Directories Accessible to External Parties",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T15:15:01.927Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-p458-7748-mcp3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-p458-7748-mcp3"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/pull/11578",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/pull/11578"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/commit/28dc1edfb6ba5a181fe208576989063795aeadb3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/commit/28dc1edfb6ba5a181fe208576989063795aeadb3"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-p458-7748-mcp3",
        "discovery": "UNKNOWN"
      },
      "title": "Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-112948",
    "datePublished": "2026-10-20T15:15:01.927Z",
    "dateReserved": "2026-10-19T21:30:47.245Z",
    "dateUpdated": "2026-10-20T16:16:59.623Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-112948 (GCVE-0-2026-112948)

    Vulnerability from cvelistv5 – Published: 2026-10-20 15:15 – Updated: 2026-10-20 16:16
    VLAI
    Title
    Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
    Summary
    Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-20 16:16 UTC
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    • CWE-552 - Files or Directories Accessible to External Parties
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7806 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    vitest-dev vitest Affected: >= 5.0.0-beta.6, < 5.0.5
    		Create a notification for this product.
    @vitest browser Affected: >= 5.0.0-beta.6, < 5.0.5
    		Create a notification for this product.
    @vitest ui Affected: >= 5.0.0-beta.6, < 5.0.5
    		Create a notification for this product.
    vitejs vite-plus Affected: >= 1.0.0-rc.0, < 1.3.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112948",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T16:16:51.150771Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T16:16:59.623Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vitest",
          "vendor": "vitest-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.6, \u003c 5.0.5"
            }
          ]
        },
        {
          "product": "browser",
          "vendor": "@vitest",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.6, \u003c 5.0.5"
            }
          ]
        },
        {
          "product": "ui",
          "vendor": "@vitest",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.6, \u003c 5.0.5"
            }
          ]
        },
        {
          "product": "vite-plus",
          "vendor": "vitejs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0-rc.0, \u003c 1.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite\u0027s defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "CWE-552: Files or Directories Accessible to External Parties",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T15:15:01.927Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-p458-7748-mcp3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-p458-7748-mcp3"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/pull/11578",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/pull/11578"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/commit/28dc1edfb6ba5a181fe208576989063795aeadb3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/commit/28dc1edfb6ba5a181fe208576989063795aeadb3"
        },
        {
          "name": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-p458-7748-mcp3",
        "discovery": "UNKNOWN"
      },
      "title": "Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-112948",
    "datePublished": "2026-10-20T15:15:01.927Z",
    "dateReserved": "2026-10-19T21:30:47.245Z",
    "dateUpdated": "2026-10-20T16:16:59.623Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}