chore(deps): update dependency vitest to v4.1.11 [security] #5

2026-10-26T15:58:50-07:00

renovate-bot commented

2026-10-26 15:58:50 -07:00

This PR contains the following updates:

Package	Change	Age	Confidence
vitest (source)	`4.1.8` → `4.1.11`

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

CVE-2026-84373 / GHSA-82fw-gwwq-j7x9

More information

Details

Summary

@vitest/mocker registers a redirect mock's target path without validating it
against the dev server's file-serving allowlist. An attacker who can reach the
dev server's WebSocket can register a redirect mock pointing outside the project
root; when the mocked module is requested, the plugin's load hook returns
readFile(<attacker path>) as the module source, disclosing local files.

This is exploitable without authentication only through the public
mockerPlugin / standalone interceptorPlugin exports (used by third-party dev
servers), which register the handler on Vite's unauthenticated HMR socket.
Vitest's own browser mode registers mocks over a token-authenticated RPC and
is not remotely reachable by default (see Scope).

Affected code

packages/mocker/src/node/interceptorPlugin.ts.

The load hook is the file-read sink:

if (mock.type === 'redirect') {
  return readFile(mock.redirect, 'utf-8')
}

mock.redirect is derived from client input at registration time with no
boundary check:

if (event.type === 'redirect') {
  const redirectUrl = new URL(event.redirect)
  event.redirect = join(server.config.root, redirectUrl.pathname)
}
registry.register(event)

There is no server.fs.allow / server.fs.deny check and no assertion that the
resolved path stays within the project root.

Registration paths and trust boundaries

Public mockerPlugin / interceptorPlugin (unauthenticated). In
configureServer, the plugin registers server.ws.on('vitest:interceptor:register', …)
on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin
check, so any client that can reach it can register a redirect mock. This is
the path the "unauthenticated" impact applies to.
Vitest browser mode (authenticated). Mocks register over the browser RPC
(registerMock), which sits behind a per-run token (isValidApiRequest, a
random api.token). The interceptor's configureServer socket is not used for
registration here (in v5 it does not run at all, as the plugin is injected per
environment). The same missing boundary check exists on the authenticated RPC
path, but reaching it requires the token, so it is not a remote-unauthenticated
read.

Path handling

new URL(redirect).pathname combined with join(root, pathname) does not
confine reads to the root:

Special/hierarchical schemes (file:, http:) are normalized by WHATWG URL,
so .. segments are collapsed and the result stays under the root. Payloads of
the form file:///../../etc/passwd do not escape.
A non-special (opaque) scheme preserves .. in pathname, so
join(root, "../../…/etc/passwd") resolves outside the root and reads an
arbitrary file.

Even without escaping the root, the missing server.fs check allows reading any
in-root file the dev server would otherwise refuse to serve (for example an
in-root .env or source that is denied by server.fs.deny).

Scope / preconditions

This is a development-server issue. The dev server binds to localhost by
default and is not reachable from the network unless the developer exposes it
(server.host / 0.0.0.0, a LAN bind, or a proxy).
A raw (non-browser) client against a reachable server bypasses browser origin
and CORS protections entirely and can both register the mock and read the
response.
A browser-based drive-by against a localhost server is substantially mitigated
by Vite defaults: the default CORS origin allowlist is limited to localhost
origins, and server.allowedHosts blocks DNS-rebinding, so a cross-origin page
cannot read the file contents back.

Impact

Disclosure of local files readable by the dev-server process (source, in-root
.env/secrets, and, via the opaque-scheme payload, files outside the project
root). No integrity or availability impact.

Affected versions

Present since @vitest/mocker was introduced.

Affected: @vitest/mocker >= 2.1.0 (shipped in vitest and
@vitest/browser >= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.
Fixed: Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not
maintained and are not planned to receive the fix.

Fix

Validate the resolved redirect target against Vite's file-serving allowlist
(isFileLoadingAllowed) before registering it, at every registration site, and
stop registering the interceptor WebSocket events in Vitest's browser mode
(mocks there flow through the authenticated RPC).

Severity

CVSS Score: 5.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vitest-dev/vitest (vitest)

`v4.1.11`

Compare Source

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in #10992 (5146d)
browser:
- Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in #10955 (10b2c)
- Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in #10951 (9851d)
mocker:
- Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in #10974 (fe5a1)

View changes on GitHub

`v4.1.10`

Compare Source

🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #10680 (5c18d)
vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in #10661 (bae52)

View changes on GitHub

`v4.1.9`

Compare Source

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)
browser:
- Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #10555 (7fb29)
- Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #10497 and #10556 (fbc62)
mocker:
- Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #10548 (2c955)
pool:
- Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #10543 and #10564 (934b0)

View changes on GitHub

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [vitest](https://vitest.dev) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) | [`4.1.8` → `4.1.11`](https://renovatebot.com/diffs/npm/vitest/4.1.8/4.1.11) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/4.1.11?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/4.1.8/4.1.11?slim=true) | --- ### Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock [CVE-2026-84373](https://nvd.nist.gov/vuln/detail/CVE-2026-84373) / [GHSA-82fw-gwwq-j7x9](https://github.com/advisories/GHSA-82fw-gwwq-j7x9) <details> <summary>More information</summary> #### Details ##### Summary `@vitest/mocker` registers a redirect mock's target path without validating it against the dev server's file-serving allowlist. An attacker who can reach the dev server's WebSocket can register a redirect mock pointing outside the project root; when the mocked module is requested, the plugin's `load` hook returns `readFile(<attacker path>)` as the module source, disclosing local files. This is exploitable **without authentication** only through the public `mockerPlugin` / standalone `interceptorPlugin` exports (used by third-party dev servers), which register the handler on Vite's unauthenticated HMR socket. Vitest's own browser mode registers mocks over a **token-authenticated** RPC and is not remotely reachable by default (see Scope). ##### Affected code `packages/mocker/src/node/interceptorPlugin.ts`. The `load` hook is the file-read sink: ```ts if (mock.type === 'redirect') { return readFile(mock.redirect, 'utf-8') } ``` `mock.redirect` is derived from client input at registration time with no boundary check: ```ts if (event.type === 'redirect') { const redirectUrl = new URL(event.redirect) event.redirect = join(server.config.root, redirectUrl.pathname) } registry.register(event) ``` There is no `server.fs.allow` / `server.fs.deny` check and no assertion that the resolved path stays within the project root. ##### Registration paths and trust boundaries - **Public `mockerPlugin` / `interceptorPlugin` (unauthenticated).** In `configureServer`, the plugin registers `server.ws.on('vitest:interceptor:register', …)` on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin check, so any client that can reach it can register a redirect mock. This is the path the "unauthenticated" impact applies to. - **Vitest browser mode (authenticated).** Mocks register over the browser RPC (`registerMock`), which sits behind a per-run token (`isValidApiRequest`, a random `api.token`). The interceptor's `configureServer` socket is not used for registration here (in v5 it does not run at all, as the plugin is injected per environment). The same missing boundary check exists on the authenticated RPC path, but reaching it requires the token, so it is not a remote-unauthenticated read. ##### Path handling `new URL(redirect).pathname` combined with `join(root, pathname)` does **not** confine reads to the root: - Special/hierarchical schemes (`file:`, `http:`) are normalized by WHATWG URL, so `..` segments are collapsed and the result stays under the root. Payloads of the form `file:///../../etc/passwd` do **not** escape. - A non-special (opaque) scheme preserves `..` in `pathname`, so `join(root, "../../…/etc/passwd")` resolves outside the root and reads an arbitrary file. Even without escaping the root, the missing `server.fs` check allows reading any in-root file the dev server would otherwise refuse to serve (for example an in-root `.env` or source that is denied by `server.fs.deny`). ##### Scope / preconditions - This is a **development-server** issue. The dev server binds to `localhost` by default and is not reachable from the network unless the developer exposes it (`server.host` / `0.0.0.0`, a LAN bind, or a proxy). - A raw (non-browser) client against a reachable server bypasses browser origin and CORS protections entirely and can both register the mock and read the response. - A browser-based drive-by against a localhost server is substantially mitigated by Vite defaults: the default CORS origin allowlist is limited to `localhost` origins, and `server.allowedHosts` blocks DNS-rebinding, so a cross-origin page cannot read the file contents back. ##### Impact Disclosure of local files readable by the dev-server process (source, in-root `.env`/secrets, and, via the opaque-scheme payload, files outside the project root). No integrity or availability impact. ##### Affected versions Present since `@vitest/mocker` was introduced. - **Affected: `@vitest/mocker` >= 2.1.0** (shipped in `vitest` and `@vitest/browser` >= 2.1.0), through 4.1.x and the 5.0.0 pre-releases. - **Fixed:** Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not maintained and are not planned to receive the fix. ##### Fix Validate the resolved redirect target against Vite's file-serving allowlist (`isFileLoadingAllowed`) before registering it, at every registration site, and stop registering the interceptor WebSocket events in Vitest's browser mode (mocks there flow through the authenticated RPC). #### Severity - CVSS Score: 5.9 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N` #### References - [https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9](https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9) - [https://nvd.nist.gov/vuln/detail/CVE-2026-84373](https://nvd.nist.gov/vuln/detail/CVE-2026-84373) - [https://github.com/vitest-dev/vitest/pull/10972](https://github.com/vitest-dev/vitest/pull/10972) - [https://github.com/vitest-dev/vitest/pull/10974](https://github.com/vitest-dev/vitest/pull/10974) - [https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8](https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8) - [https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4](https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4) - [https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f](https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f) - [https://github.com/vitest-dev/vitest](https://github.com/vitest-dev/vitest) - [https://github.com/vitest-dev/vitest/releases/tag/v4.1.11](https://github.com/vitest-dev/vitest/releases/tag/v4.1.11) - [https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2](https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-82fw-gwwq-j7x9) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>vitest-dev/vitest (vitest)</summary> ### [`v4.1.11`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.11) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.10...v4.1.11) ##### 🐞 Bug Fixes - Revive global concurrency limit for test lifecycle \[backport to v4] - by [@sheremet-va](https://github.com/sheremet-va) and [@hi-ogawa](https://github.com/hi-ogawa) in [#10992](https://github.com/vitest-dev/vitest/issues/10992) [<samp>(5146d)</samp>](https://github.com/vitest-dev/vitest/commit/5146df80b) - **browser**: - Encode iframeId in tester iframe URL \[backport to v4] - by [@sheremet-va](https://github.com/sheremet-va), **Pduhard** and **Claude Opus 4.8** in [#10955](https://github.com/vitest-dev/vitest/issues/10955) [<samp>(10b2c)</samp>](https://github.com/vitest-dev/vitest/commit/10b2cd201) - Trigger playwright/chromium gc on lower disk availability \[backport to v4] - by [@hi-ogawa](https://github.com/hi-ogawa), **Hiroshi Ogawa** and **OpenCode** in [#10951](https://github.com/vitest-dev/vitest/issues/10951) [<samp>(9851d)</samp>](https://github.com/vitest-dev/vitest/commit/9851dbc41) - **mocker**: - Restrict redirect mocks to the fs allowlist \[backport to v4] - by [@sheremet-va](https://github.com/sheremet-va) in [#10974](https://github.com/vitest-dev/vitest/issues/10974) [<samp>(fe5a1)</samp>](https://github.com/vitest-dev/vitest/commit/fe5a11d3c) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.10...v4.1.11) ### [`v4.1.10`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.10) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10) ##### 🐞 Bug Fixes - **browser**: Check fs access in builtin commands \[backport to v4] - by [@hi-ogawa](https://github.com/hi-ogawa), **Hiroshi Ogawa** and **OpenCode (claude-opus-4-8)** in [#10680](https://github.com/vitest-dev/vitest/issues/10680) [<samp>(5c18d)</samp>](https://github.com/vitest-dev/vitest/commit/5c18dd267) - **vm**: Fix external module resolve error with deps optimizer query for encoded URI \[backport to v4] - by [@SveLil](https://github.com/SveLil) and [@hi-ogawa](https://github.com/hi-ogawa) in [#10661](https://github.com/vitest-dev/vitest/issues/10661) [<samp>(bae52)</samp>](https://github.com/vitest-dev/vitest/commit/bae52b511) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10) ### [`v4.1.9`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.9) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9) ##### 🐞 Bug Fixes - Fix `importOriginal` with optimizer and query import \[backport to v4] - by **Hiroshi Ogawa**, **David Harris**, **Codex**and **Vladimir** in [#10546](https://github.com/vitest-dev/vitest/issues/10546) [<samp>(a5180)</samp>](https://github.com/vitest-dev/vitest/commit/a5180190c) - **browser**: - Wait for orchestrator readiness before resolving browser sessions \[backport to v4] - by **Vladimir** and **Séamus O'Connor** in [#10555](https://github.com/vitest-dev/vitest/issues/10555) [<samp>(7fb29)</samp>](https://github.com/vitest-dev/vitest/commit/7fb29651a) - Wait for iframe tester readiness before preparing \[backport to v4] - by **Vladimir** and **Séamus O'Connor** in [#10497](https://github.com/vitest-dev/vitest/issues/10497) and [#10556](https://github.com/vitest-dev/vitest/issues/10556) [<samp>(fbc62)</samp>](https://github.com/vitest-dev/vitest/commit/fbc626c40) - **mocker**: - Hoist vi.mock() for vite-plus/test imports \[backport to v4] - by **Hiroshi Ogawa**, **LongYinan**, **Claude Opus 4.8** and **Vladimir** in [#10548](https://github.com/vitest-dev/vitest/issues/10548) [<samp>(2c955)</samp>](https://github.com/vitest-dev/vitest/commit/2c9559c02) - **pool**: - Prevent test run hang on worker crash \[backport to v4] - by **Ari Perkkiö** and **Jattioui Ismail** in [#10543](https://github.com/vitest-dev/vitest/issues/10543) and [#10564](https://github.com/vitest-dev/vitest/issues/10564) [<samp>(934b0)</samp>](https://github.com/vitest-dev/vitest/commit/934b0f587) ##### [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9) </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Los_Angeles) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit 2026-10-26 15:58:50 -07:00

chore(deps): update dependency vitest to v4.1.11 [security] 6add22f8b6

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/npm-vitest-vulnerability:renovate/npm-vitest-vulnerability

git checkout renovate/npm-vitest-vulnerability

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: TehRiehlDeal/skill-tree-portfolio#5

chore(deps): update dependency vitest to v4.1.11 [security] #5

Vitest: Path Traversal / Arbitrary File Read via @​vitest/mocker Redirect Mock

Details

Summary

Affected code

Registration paths and trust boundaries

Path handling

Scope / preconditions

Impact

Affected versions

Fix

Severity

References

Release Notes

v4.1.11

🐞 Bug Fixes

View changes on GitHub

v4.1.10

🐞 Bug Fixes

View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

Configuration

Checkout

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

`v4.1.11`

`v4.1.10`

`v4.1.9`