Vitest CVE-2026-84373

Exploitation requires the Vite HMR WebSocket port (default 5173) to be reachable from an untrusted network - by default Vite binds to localhost only, so this is not reachable remotely unless the developer starts the server with --host 0.0.0.0, server.host: true, exposes the port via Docker port mapping, or operates in a cloud development environment (e.g., GitHub Codespaces, Gitpod) where ports are forwarded. The vitest:interceptor:register WebSocket handler requires no authentication. Exploitation further requires sending a redirect URL using an opaque URL scheme (e.g., traversal:, custom:) so that URL.pathname retains literal .. segments that path.join() resolves; standard relative paths or file:// URLs may be normalized by the parser and fail to traverse. The vitest browser mode RPC path is NOT exploitable via the unauthenticated WebSocket because it uses a separate token-authenticated channel. Vitest is a development-only tool and should never be exposed on production systems.

The CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) is well-calibrated. AC:H reflects a genuine exploitation prerequisite: the attacker must use an opaque URL scheme to prevent .. normalization, a non-obvious but documented technique. Confidentiality impact is high because the attacker can read arbitrary files accessible to the dev-server process - potentially source code, credentials, private keys, or .env files. No integrity or availability impact applies. No EPSS score was provided; real-world exploitation probability is substantially constrained by the deployment context: Vite dev servers bind to localhost by default, meaning exploitation requires either an insider-adjacent network position or a developer deliberately exposing the HMR port (e.g., --host 0.0.0.0, Docker port mapping, or a cloud development environment). No KEV listing and no known active exploitation reduce urgency for most organizations. However, the fix PR's e2e test (mocker-redirect-traversal.test.ts) provides a complete, copy-pasteable WebSocket PoC, lowering the barrier for exploit development significantly. For teams running Vitest in CI pipelines on shared runners or network-accessible cloud dev environments, risk is meaningfully higher than the CVSS base score alone suggests.

An attacker on the same network as a developer running vitest --host 0.0.0.0 connects directly to the exposed Vite HMR WebSocket on port 5173 and sends a crafted JSON message of type custom with event vitest:interceptor:register and a redirect field set to traversal:../../../home/developer/.env. The interceptor resolves the path outside the project root and registers the traversed file as a mock redirect; when the attacker subsequently requests the /mock virtual module endpoint, the dev server returns the .env file contents as JavaScript module source. The GitHub PR #10972 e2e test demonstrates this exact payload, making exploit construction trivial for anyone who reads the patch.