Pull Request Overview

Opened on September 16, 2026
Status Open
Commit count 2 with first commit September 16, 2026

Total Delta

0 Total Diff Delta

Open Days

Open 2 weekdays

Test Delta

0 Diff Delta in Test Files

Breakdown by Phase

How long has this pull request spent in each phase of its lifecycle?

Fraction of total time	Business days	Phase
	0.0 days	Authoring 0 commits before pull request opened for review
	0.0 days	Awaiting first review
	2.6 days	Revising work with 2 commits in response to 0 reviews that left 2 comments

Total time for pull request still awaiting merge: 2.6 business days

Update dependency vitest [SECURITY]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Change | Age | Confidence |
|---|---|---|---|
| vitest (source) | 4.1.10 → 5.0.0 | age | |
| vitest (source) | ^4.1.0 → ^5.0.0 | age | |
| vitest (source) | 5.0.0-beta.3 → 5.0.0-rc.2 | age | |

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

CVE-2026-84373 / GHSA-82fw-gwwq-j7x9

More information

#### Details
##### Summary
`@vitest/mocker` registers a redirect mock's target path without validating it
against the dev server's file-serving allowlist. An attacker who can reach the
dev server's WebSocket can register a redirect mock pointing outside the project
root; when the mocked module is requested, the plugin's `load` hook returns
`readFile()` as the module source, disclosing local files.

This is exploitable **without authentication** only through the public
`mockerPlugin` / standalone `interceptorPlugin` exports (used by third-party dev
servers), which register the handler on Vite's unauthenticated HMR socket.
Vitest's own browser mode registers mocks over a **token-authenticated** RPC and
is not remotely reachable by default (see Scope).

##### Affected code
`packages/mocker/src/node/interceptorPlugin.ts`.

The `load` hook is the file-read sink:

```ts
if (mock.type === 'redirect') {
return readFile(mock.redirect, 'utf-8')
}
```

`mock.redirect` is derived from client input at registration time with no
boundary check:

```ts
if (event.type === 'redirect') {
const redirectUrl = new URL(event.redirect)
event.redirect = join(server.config.root, redirectUrl.pathname)
}
registry.register(event)
```

There is no `server.fs.allow` / `server.fs.deny` check and no assertion that the
resolved path stays within the project root.

##### Registration paths and trust boundaries
- **Public `mockerPlugin` / `interceptorPlugin` (unauthenticated).** In
`configureServer`, the plugin registers `server.ws.on('vitest:interceptor:register', …)`
on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin
check, so any client that can reach it can register a redirect mock. This is
the path the "unauthenticated" impact applies to.
- **Vitest browser mode (authenticated).** Mocks register over the browser RPC
(`registerMock`), which sits behind a per-run token (`isValidApiRequest`, a
random `api.token`). The interceptor's `configureServer` socket is not used for
registration here (in v5 it does not run at all, as the plugin is injected per
environment). The same missing boundary check exists on the authenticated RPC
path, but reaching it requires the token, so it is not a remote-unauthenticated
read.

##### Path handling
`new URL(redirect).pathname` combined with `join(root, pathname)` does **not**
confine reads to the root:

- Special/hierarchical schemes (`file:`, `http:`) are normalized by WHATWG URL,
so `..` segments are collapsed and the result stays under the root. Payloads of
the form `file:///../../etc/passwd` do **not** escape.
- A non-special (opaque) scheme preserves `..` in `pathname`, so
`join(root, "../../…/etc/passwd")` resolves outside the root and reads an
arbitrary file.

Even without escaping the root, the missing `server.fs` check allows reading any
in-root file the dev server would otherwise refuse to serve (for example an
in-root `.env` or source that is denied by `server.fs.deny`).

##### Scope / preconditions
- This is a **development-server** issue. The dev server binds to `localhost` by
default and is not reachable from the network unless the developer exposes it
(`server.host` / `0.0.0.0`, a LAN bind, or a proxy).
- A raw (non-browser) client against a reachable server bypasses browser origin
and CORS protections entirely and can both register the mock and read the
response.
- A browser-based drive-by against a localhost server is substantially mitigated
by Vite defaults: the default CORS origin allowlist is limited to `localhost`
origins, and `server.allowedHosts` blocks DNS-rebinding, so a cross-origin page
cannot read the file contents back.

##### Impact
Disclosure of local files readable by the dev-server process (source, in-root
`.env`/secrets, and, via the opaque-scheme payload, files outside the project
root). No integrity or availability impact.

##### Affected versions
Present since `@vitest/mocker` was introduced.

- **Affected: `@vitest/mocker` >= 2.1.0** (shipped in `vitest` and
`@vitest/browser` >= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.
- **Fixed:** Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not
maintained and are not planned to receive the fix.

##### Fix
Validate the resolved redirect target against Vite's file-serving allowlist
(`isFileLoadingAllowed`) before registering it, at every registration site, and
stop registering the interceptor WebSocket events in Vitest's browser mode
(mocks there flow through the authenticated RPC).

#### Severity
- CVSS Score: 5.9 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-82fw-gwwq-j7x9) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).

Release Notes

vitest-dev/vitest (vitest)

### [`v5.0.0`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v5.0.0)

[Compare Source](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.11...v5.0.0)

##### 🚨 Breaking Changes

##### 🚀 Features

##### 🐞 Bug Fixes

> ❗ **Important**
>
> ✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)

Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

[ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Comments Threads Pending Resolution

Resolved Comment Threads

No resolved comments have been left on this PR.

Update dependency vitest [SECURITY] #18026