Vitest CVE-2026-112948

Requires an affected version (Vitest 5.0.0-beta.6 through 5.0.4, incl. @vitest/ui and @vitest/browser) running a Vitest UI, Browser Mode, or API dev server that the attacker can reach over the network - these servers are development-time only and are typically bound to localhost, so the chief limiting factor is whether the server is exposed on a non-loopback interface. The .env-exposure variant additionally requires the victim to be running Browser Mode with test.projects configured and to visit an attacker-controlled website (UI:R), and only exposes JavaScript-compatible .env values. The token/denied-file read targets node_modules/.vitest/.vitest-secret-token and project files that server.fs.deny should have blocked.

This is a medium-severity information-disclosure flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) whose real-world priority is modest despite the network attack vector and lack of required privileges. The confidentiality-only impact (I:N/A:N) and the UI:R requirement for the most practical attack path (a malicious website querying a victim's Browser Mode server) both constrain exploitation. Critically, the affected component is a development-time dev server (UI, Browser Mode, or API server) that is not normally exposed to untrusted networks by default, which sharply limits exposure relative to the AV:N rating. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public exploit code was identified - exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a legitimately network-reachable dev server could leak the fallback API token or fs.deny-protected files, but the dependence on an exposed dev server and/or victim interaction makes this a lower real-world risk than the raw 6.5 suggests. Verify whether any affected dev server is bound to a non-loopback interface in your environment, as that is the determining risk factor.

A developer runs an affected Vitest (5.0.0-beta.6 to 5.0.4) dev server reachable beyond localhost, or uses Browser Mode with test.projects and is lured to a malicious website. The attacker's page (or direct request) reaches the server and retrieves files that server.fs.deny should block - including node_modules/.vitest/.vitest-secret-token or JavaScript-compatible .env values - because project servers replace Vite's default deny matcher and the root server appends the token too late. No public exploit code is known; attack complexity is low once the server is reachable, but the malicious-website path requires user interaction (UI:R).