{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "@vitest mocker: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/vitest--mocker/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/vitest--mocker/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112950/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112950/",
   "title": "CVE-2026-112950 · vitest-dev vitest · disclosed",
   "content_text": "Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.",
   "date_published": "2026-10-20T15:21:32Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112950/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112950/",
   "title": "CVE-2026-112950 · vitest-dev vitest · fixed in Chainguard (gitlab-rails-ce-18.11 18.11.13-r0 and 6 more)",
   "content_text": "Fixed versions: gitlab-rails-ce-18.11 18.11.13-r0, gitlab-rails-ce-19.1 19.1.9-r0, gitlab-rails-ce-fips-19.2 19.2.9-r2, langfuse-4-worker 4.68.0-r0, langfuse-fips-4-worker 4.68.0-r0, renovate 44.178.1-r0, vitess-24 24.0.5-r3.",
   "date_published": "2026-10-20T15:21:32Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112950/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112950/",
   "title": "CVE-2026-112950 · vitest-dev vitest · fixed upstream (npm)",
   "content_text": "Fixed versions: @vitest/mocker 4.1.12, @vitest/mocker 5.0.3.",
   "date_published": "2026-10-20T15:21:32Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112950/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112950/",
   "title": "CVE-2026-112950 · vitest-dev vitest · fixed in Wolfi (renovate 44.178.1-r0 and 1 more)",
   "content_text": "Fixed versions: renovate 44.178.1-r0, vitess-24 24.0.5-r3.",
   "date_published": "2026-10-20T15:21:32Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112949/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112949/",
   "title": "CVE-2026-112949 · vitest-dev vitest · disclosed",
   "content_text": "Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.",
   "date_published": "2026-10-20T15:19:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112949/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112949/",
   "title": "CVE-2026-112949 · vitest-dev vitest · fixed in Chainguard (gitlab-rails-ce-18.11 18.11.13-r0 and 7 more)",
   "content_text": "Fixed versions: gitlab-rails-ce-18.11 18.11.13-r0, gitlab-rails-ce-19.0 19.0.10-r0, gitlab-rails-ce-19.1 19.1.9-r0, gitlab-rails-ce-fips-19.2 19.2.9-r2, langfuse-4-worker 4.68.0-r0, langfuse-fips-4-worker 4.68.0-r0, renovate 44.178.1-r0, vitess-24 24.0.5-r3.",
   "date_published": "2026-10-20T15:19:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112949/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112949/",
   "title": "CVE-2026-112949 · vitest-dev vitest · fixed upstream (npm)",
   "content_text": "Fixed versions: @vitest/mocker 4.1.12, @vitest/mocker 5.0.3.",
   "date_published": "2026-10-20T15:19:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112949/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112949/",
   "title": "CVE-2026-112949 · vitest-dev vitest · fixed in Wolfi (renovate 44.178.1-r0 and 1 more)",
   "content_text": "Fixed versions: renovate 44.178.1-r0, vitess-24 24.0.5-r3.",
   "date_published": "2026-10-20T15:19:03Z"
  }
 ]
}