Описание
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitest_attachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.
A flaw was found in Vitest, a testing framework. On Windows, the Vitest UI/API server incorrectly handled file serving, which could allow an attacker to read sensitive files outside the project directory. Additionally, exposed API features could be exploited to execute arbitrary scripts, leading to potential system compromise.
Отчет
Vitest ships a UI and API server (enabled via the --ui or --api flags, or automatically as part of Browser Mode) that exposes file read, file write, and test-rerun functionality over HTTP. Due to an incorrect path-traversal check in the /vitest_attachment handler and related code paths, a remote attacker who can reach this server can read arbitrary files, and via the write/rerun features can achieve arbitrary code execution. Exploitation requires either exposing the server to a network host (--api.host / api.host config) or running the UI/Browser Mode on Windows.
Red Hat's shipped products use vitest exclusively as a development-time unit test runner (invoked as vitest run, test:unit, or --project in CI/build pipelines). None of the Red Hat products that ship vitest start its UI server, API server, or Browser Mode as part of their build process or shipped runtime. The @vitest/browser package (required for Browser Mode) is not present in any Red Hat product's manifest. As a result, the vulnerable code path is not reachable in any Red Hat product covered by this flaw, and affects are set to NOTAFFECTED / Vulnerable Code not in Execute Path.
Меры по смягчению последствий
No mitigation is required for Red Hat products, as none run Vitest's UI/API server or Browser Mode in their build or shipped runtime.
Developers who run vitest --ui, vitest --api, or Browser Mode interactively should avoid binding the server to a non-localhost host, and should upgrade to vitest >= 4.1.0 (or >= 3.2.5 on the 3.x branch), where the allowWrite/allowExec flags default to disabled whenever the server is bound to a non-localhost host.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat AMQ Broker 7 | vitest | Not affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/gateway-rhel9 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/gateway-rhel9 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | Not affected | ||
| Red Hat Build of Keycloak | vitest | Not affected | ||
| Red Hat Build of Podman Desktop | rh-podman-desktop.git | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | vitest | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | vitest | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-agent-installer-ui-rhel9 | Not affected | ||
| Red Hat Hardened Images | prometheus3-13-main-3.13.1-0.1.hum1 | Fixed | RHSA-2026:39058 | 13.07.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.
When Vitest UI server is listening, arbitrary file can be read and executed
EPSS
8.1 High
CVSS3