{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-84373", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-01T16:27:58.129Z", "datePublished": "2026-09-01T21:26:26.110Z", "dateUpdated": "2026-09-01T21:26:26.110Z"}, "containers": {"cna": {"title": "Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9"}, {"name": "https://github.com/vitest-dev/vitest/pull/10972", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/pull/10972"}, {"name": "https://github.com/vitest-dev/vitest/pull/10974", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/pull/10974"}, {"name": "https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8"}, {"name": "https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4"}, {"name": "https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f"}, {"name": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.11", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.11"}, {"name": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2"}], "affected": [{"vendor": "vitest-dev", "product": "vitest", "versions": [{"version": ">= 2.1.0, < 4.1.11", "status": "affected"}, {"version": ">= 5.0.0-beta.1, < 5.0.0-rc.2", "status": "affected"}]}, {"vendor": "@vitest", "product": "mocker", "versions": [{"version": ">= 2.1.0, < 4.1.11", "status": "affected"}, {"version": ">= 5.0.0-beta.1, < 5.0.0-rc.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-01T21:26:26.110Z"}, "descriptions": [{"lang": "en", "value": "Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2."}], "source": {"advisory": "GHSA-82fw-gwwq-j7x9", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "vitest", "vendor": "vitest-dev", "versions": [{"status": "affected", "version": ">= 2.1.0, < 4.1.11"}, {"status": "affected", "version": ">= 5.0.0-beta.1, < 5.0.0-rc.2"}]}, {"product": "mocker", "vendor": "@vitest", "versions": [{"status": "affected", "version": ">= 2.1.0, < 4.1.11"}, {"status": "affected", "version": ">= 5.0.0-beta.1, < 5.0.0-rc.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2."}], "id": "CVE-2026-84373", "lastModified": "2026-09-01T22:17:19.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-09-01T22:17:19.143", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8"}, {"source": "security-advisories@github.com", "url": "https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4"}, {"source": "security-advisories@github.com", "url": "https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f"}, {"source": "security-advisories@github.com", "url": "https://github.com/vitest-dev/vitest/pull/10972"}, {"source": "security-advisories@github.com", "url": "https://github.com/vitest-dev/vitest/pull/10974"}, {"source": "security-advisories@github.com", "url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.11"}, {"source": "security-advisories@github.com", "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "vitest: Vitest: Arbitrary File Read via Path Traversal in HMR WebSocket", "id": "2527102", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527102"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in Vitest, a testing framework. A remote attacker, able to reach an exposed development server, could exploit an issue in the mockerPlugin and interceptorPlugin exports. These plugins register a handler on Vite's unauthenticated HMR WebSocket without properly validating redirect targets. By submitting a specially crafted URL with path traversal segments, an attacker could read arbitrary local files accessible by the development server process, leading to information disclosure."], "name": "CVE-2026-84373", "package_state": [{"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Fix deferred", "package_name": "amq-broker-bin.zip", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Fix deferred", "package_name": "amq-broker-maven-repository.zip", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "automation-gateway", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "automation-platform-ui", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "keycloak-operator.redhat-00001.zip", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "rhbk-quarkus-dist.zip", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Fix deferred", "package_name": "rh-podman-desktop.git", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "rh-podman-desktop", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "jaeger", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "opentelemetry-collector", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "opentelemetry-collector-contrib", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "opentelemetry-collector-k8s", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "prometheus3.13", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "jboss-eap.1-runtime-maven-repository.zip", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "jboss-eap-runtime-maven-repository.zip", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "jboss-eap.1-runtime-maven-repository.zip", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "jboss-eap-runtime-maven-repository.zip", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Out of support scope", "package_name": "rhtas/rhtas-console-ui-rhel9", "product_name": "Red Hat Trusted Artifact Signer"}], "public_date": "2026-09-01T21:26:26Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-84373\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84373\nhttps://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8\nhttps://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4\nhttps://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f\nhttps://github.com/vitest-dev/vitest/pull/10972\nhttps://github.com/vitest-dev/vitest/pull/10974\nhttps://github.com/vitest-dev/vitest/releases/tag/v4.1.11\nhttps://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2\nhttps://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9"], "threat_severity": "Moderate"}

{"created": "2026-09-01T23:30:05.343392+00:00", "updated": "2026-09-01T23:30:05.343399+00:00", "vendors": []}