CVE-2026-112948

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.

• CWE-200
• CWE-552

• https://github.com/vitest-dev/vitest/commit/28dc1edfb6ba5a181fe208576989063795aeadb3
• https://github.com/vitest-dev/vitest/pull/11578
• https://github.com/vitest-dev/vitest/releases/tag/v5.0.5
• https://github.com/vitest-dev/vitest/security/advisories/GHSA-p458-7748-mcp3

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112942launch-editor allows users to open files with line numbers i…7.5
• CVE-2026-112943launch-editor allows users to open files with line numbers i…6.3
• CVE-2026-112944launch-editor allows users to open files with line numbers i…6.3
• CVE-2026-112945Vite is a frontend tooling framework for JavaScript. Prior t…2.1
• CVE-2026-112946Vite is a frontend tooling framework for JavaScript. Prior t…6.3
• CVE-2026-112947Vite is a frontend tooling framework for JavaScript. From 8.…6.3
• CVE-2026-112949Vitest is a Vite-native testing framework for JavaScript and…4.7
• CVE-2026-11295Inappropriate implementation in WebView in Google Chrome on …8.8
• CVE-2026-112950Vitest is a Vite-native testing framework for JavaScript and…5.9
• CVE-2026-112951ApostropheCMS is an open-source Node.js content management s…5.4
• CVE-2026-112952ApostropheCMS is an open-source Node.js content management s…4.3
• CVE-2026-112953ApostropheCMS is an open-source Node.js content management s…6