CVE-2026-47429 is a critical path traversal vulnerability (CWE-22) in the Vitest testing framework's UI/API server on Windows platforms. The vulnerability arises from incorrect use of the isFileServingAllowed function for the /__vitest_attachment__ path, permitting specially crafted paths (e.g., \\?\\..\\) to access files outside the intended project directory. Additionally, exposed API features such as saveTestFile and rerun can be abused to execute arbitrary scripts. This vulnerability affects Vitest versions prior to 3.2.5 and versions from 4.0.0 up to but not including 4.1.0. The issue is resolved in Vitest versions 3.2.5 and 4.1.0.

Successful exploitation allows an unauthenticated attacker to read arbitrary files outside the project directory on Windows systems and potentially execute arbitrary scripts via the exposed API write and rerun features. This leads to full confidentiality, integrity, and availability compromise of the affected system as indicated by the CVSS score of 9.8 (critical).

Upgrade Vitest to version 3.2.5 or later, or 4.1.0 or later, where this vulnerability is fixed. Patch status is confirmed by the vendor advisory indicating fixes in these versions. No other mitigations are specified or required once upgraded.