CVE-2026-112950: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in vitest-dev vitest

Vitest versions >=4.1.11 <4.1.12 and >=5.0.0-rc.2 <5.0.3 contain a path traversal vulnerability (CWE-22) due to improper handling of backslash characters in filesystem paths on Windows. The isFileLoadingAllowed function and filesystem read operations interpret backslashes differently, enabling a client able to reach the Vite dev server to register a redirect mock with backslash traversal sequences. This causes POSIX path joining to preserve Windows backslash traversal, which the filesystem read then interprets as path separators, allowing unauthorized file reads outside the configured server.fs.allow directory. The vulnerability is resolved in versions 4.1.12 and 5.0.3.

An unauthenticated remote attacker who can access the Vite development server on Windows can exploit this vulnerability to read arbitrary files accessible to the Vitest process outside the intended restricted directory. This leads to confidentiality breaches but does not affect integrity or availability. The CVSS 3.1 score is 5.9 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to confidentiality.

Upgrade Vitest to version 4.1.12 or later, or 5.0.3 or later, where this path traversal vulnerability is fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed fixed in these versions.