CVE-2026-47429

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

• CWE-22

• https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8dPatch
• https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8Patch
• https://github.com/vitest-dev/vitest/pull/10445Exploit, Issue Tracking, Patch
• https://github.com/vitest-dev/vitest/pull/9350Exploit, Issue Tracking, Patch
• https://github.com/vitest-dev/vitest/releases/tag/v3.2.5Release Notes
• https://github.com/vitest-dev/vitest/releases/tag/v4.1.0Release Notes
• https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwpExploit, Mitigation, Vendor Advisory
• https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwpExploit, Mitigation, Vendor Advisory

Published

Jul 14, 2026

Last Modified

Aug 6, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4742Inconsistent Interpretation of HTTP Requests ('HTTP Request/…2.9
• CVE-2026-47422Frappe is a full-stack web application framework. Prior to 1…5.3
• CVE-2026-47423DOMPurify is a DOM-only cross-site scripting sanitizer for H…8.2
• CVE-2026-47425Rattler is a library that provides common functionality used…6.9
• CVE-2026-47427GitHub MCP Server is GitHub's official MCP Server. Prior to …7.5
• CVE-2026-47428Vitest is a testing framework powered by Vite. From 4.0.17 u…9.6
• CVE-2026-4743NULL Pointer Dereference vulnerability in taurusxin ncmdump …5.2
• CVE-2026-47430## Summary The iOS implementation of `cordova-plugin-inappb…7.5
• CVE-2026-4744Out-of-bounds Read vulnerability in rizonesoft Notepad3 (‎sc…9.3
• CVE-2026-4745Improper Control of Generation of Code ('Code Injection') vu…10
• CVE-2026-4746Out-of-bounds Write vulnerability in timeplus-io proton (bas…10
• CVE-2026-4747Each RPCSEC_GSS data packet is validated by a routine which …8.8