CVE-2026-47429
Fixed in a distro release EPSS <1%CVSS 9.8
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.
Products: vitest-dev vitest
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | vitest | 4.1.0 |
| npm | vitest | 3.2.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-gitlab-rails-ee-fips-19.1 | 19.1.9-r0 |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.6-r7 |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.3-r3 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.2-r2 |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.6-r3 |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.3-r4 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.1-r3 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.1-r1 |
| Chainguard | langfuse-2-worker | 2.95.12-r25 |
| Chainguard | langfuse-fips-2-worker | 2.95.12-r27 |
| Chainguard | vitess-22 | no fix |
| Chainguard | vitess-23 | 23.0.4-r8 |
| Red Hat hummingbird 1 | prometheus3.13 | 0:3.13.1-0.1.hum1 |
| Wolfi | vitess-23 | 23.0.4-r8 |