CVE-2026-112948: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in vitest-dev vitest

Vitest, a testing framework powered by Vite, has a vulnerability (CVE-2026-112948) in versions >=5.0.0-beta.6 <5.0.5 and >=1.0.0-rc.0 <1.3.0 where the dev servers incorrectly apply file system deny rules due to project servers replacing Vite's defaults and the root server adding a secret token file after Vite compiles its matcher. This misconfiguration allows unauthorized actors who can reach the affected UI, Browser Mode, or API server to access denied project files and a fallback API token located at node_modules/.vitest/.vitest-secret-token. Furthermore, Browser Mode with test.projects can expose environment variables (.env) that are JavaScript-compatible to malicious websites. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information) and CWE-552 (Files or Directories Accessible to External Parties). The issue has been resolved in version 5.0.5.

An attacker able to access the affected Vitest dev server interfaces can read sensitive files that should be protected, including a fallback API token, potentially compromising security. Exposure of environment variables through Browser Mode can leak sensitive configuration data to malicious websites. This can lead to unauthorized information disclosure without requiring privileges or authentication, but user interaction (UI access) is needed.

Upgrade Vitest to version 5.0.5 or later, where this vulnerability is fixed. No other specific mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 5.0.5.