NPM: Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

NPM: Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock vulnerability discovered by ? in WordPress Npm vitest versions = 2.1.0, 4.1.11...

GHSA-82FW-GWWQ-J7X9 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Summary @vitest/mocker registers a redirect mock's target path without validating it against the dev server's file-serving allowlist. An attacker who can reach the dev server's WebSocket can register a redirect mock pointing outside the project root; when the mocked module is requested, the...

@0xshogun/sdk (>=1.0.3, <=1.1.6), @100xsystems/test-suite-typescript (>=0.1.0, <=0.1.2) +1673 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=2.1.0, <=4.1.10)

@vitest/mocker NPM version =2.1.0, =1.0.3, =0.1.0, =0.0.1, =0.2.4, =0.0.3, =0.2.0, =0.0.1, =0.1.1, =0.1.1, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =0.0.14, =0.0.16 and more Source cves: CVE-2026-84373 Source advisory: OSV:GHSA-82FW-GWWQ-J7X9...

@pixui-dev/inflight-report (>=0.0.7-inflight.3, <=0.1.0), @vitest/browser (>=5.0.0-beta.1, <=5.0.0-rc.1) +4 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=5.0.0-beta.1, <=5.0.0-rc.1)

@vitest/mocker NPM version =5.0.0-beta.1, =0.0.7-inflight.3, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-rc.1 Source cves: CVE-2026-84373 Source advisory: GHSA-82FW-GWWQ-J7X9...

@0xshogun/sdk (>=1.0.3, <=1.1.6), @100xsystems/test-suite-typescript (>=0.1.0, <=0.1.2) +1673 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=2.1.0, <=4.1.10)

@vitest/mocker NPM version =2.1.0, =1.0.3, =0.1.0, =0.0.1, =0.2.4, =0.0.3, =0.2.0, =0.0.1, =0.1.1, =0.1.1, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =0.0.14, =0.0.16 and more Source cves: CVE-2026-84373 Source advisory: GHSA-82FW-GWWQ-J7X9...

@pixui-dev/inflight-report (>=0.0.7-inflight.3, <=0.1.0), @vitest/browser (>=5.0.0-beta.1, <=5.0.0-rc.1) +4 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=5.0.0-beta.1, <=5.0.0-rc.1)

@vitest/mocker NPM version =5.0.0-beta.1, =0.0.7-inflight.3, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-rc.1 Source cves: CVE-2026-84373 Source advisory: OSV:GHSA-82FW-GWWQ-J7X9...

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Summary @vitest/mocker registers a redirect mock's target path without validating it against the dev server's file-serving allowlist. An attacker who can reach the dev server's WebSocket can register a redirect mock pointing outside the project root; when the mocked module is requested, the...

Directory Traversal

Overview @vitest/mocker is a Vitest module mocker implementation Affected versions of this package are vulnerable to Directory Traversal through the interceptorPlugin redirect-mock handling in packages/mocker/src/node/interceptorPlugin.ts. An attacker can make the plugin register a redirect mock...

@pixui-dev/inflight-report (>=0.0.7-inflight.3, <=0.1.0), @vitest/browser (>=5.0.0-beta.1, <=5.0.0-rc.1) +4 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=5.0.0-beta.1, <=5.0.0-rc.1)

@vitest/mocker NPM version =5.0.0-beta.1, =0.0.7-inflight.3, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-rc.1 Source cves: CVE-2026-84373 Source advisory: SNYK:JS-VITESTMOCKER-19497933...

@0xshogun/sdk (>=1.0.3, <=1.1.6), @100xsystems/test-suite-typescript (>=0.1.0, <=0.1.2) +1673 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=2.1.0, <=4.1.10)

@vitest/mocker NPM version =2.1.0, =1.0.3, =0.1.0, =0.0.1, =0.2.4, =0.0.3, =0.2.0, =0.0.1, =0.1.1, =0.1.1, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =0.0.14, =0.0.16 and more Source cves: CVE-2026-84373 Source advisory: SNYK:JS-VITESTMOCKER-19497933...

CVE-2026-84373

CVE-2026-84373 affects Vitest (a Vite-powered testing framework) versions 2.1.0 through 4.1.10 and 5.0.0-rc.1 . The vulnerability exists in the mockerPlugin and interceptorPlugin exports within packages/mocker/src/node/interceptorPlugin.ts, which register a vitest:interceptor:register handler on ...

@0xshogun/sdk (>=1.0.3, <=1.1.6), @100xsystems/test-suite-typescript (>=0.1.0, <=0.1.2) +1673 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=2.1.0, <=4.1.10)

@vitest/mocker NPM version =2.1.0, =1.0.3, =0.1.0, =0.0.1, =0.2.4, =0.0.3, =0.2.0, =0.0.1, =0.1.1, =0.1.1, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =0.0.14, =0.0.16 and more Source cves: CVE-2026-84373 Source advisory: MEND:CVE-2026-84373...

@pixui-dev/inflight-report (>=0.0.7-inflight.3, <=0.1.0), @vitest/browser (>=5.0.0-beta.1, <=5.0.0-rc.1) +4 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=5.0.0-beta.1, <=5.0.0-rc.1)

@vitest/mocker NPM version =5.0.0-beta.1, =0.0.7-inflight.3, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-rc.1 Source cves: CVE-2026-84373 Source advisory: MEND:CVE-2026-84373...