CVE-2026-112950

A flaw was found in the Vitest mocker component when running on Windows systems. A remote attacker with access to the development server can exploit inconsistent path separator handling between file access validation and filesystem operations. By registering mock requests containing backslash...

CLSA-2026-1793115217 TuxCare security update for @vitest/mocker (1 CVE)

TuxCare rebuilt @vitest/mocker to address 1 CVE. Fixed in 4.0.18-tuxcare.5...

CLSA-2026-1793114894 TuxCare security update for @vitest/mocker (1 CVE)

TuxCare rebuilt @vitest/mocker to address 1 CVE. Fixed in 3.2.4-tuxcare.5...

Vitest: Windows Backslash Traversal Bypasses The @vitest/mocker Redirect Allowlist Fix

Summary The path traversal fix released for "GHSA-82fw-gwwq-j7x9" https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9 can be bypassed on Windows by using a backslash in the redirect URL pathname. The fixed code joins an attacker-controlled URL pathname with the Vite root...

Vitest: Code Injection Via Unauthenticated Manual Mock Registration

Summary "@vitest/mocker"'s "interceptorPlugin" accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's "url" into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place ...

Vitest: Code injection via unauthenticated manual mock registration

Summary @vitest/mocker's interceptorPlugin accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's url into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any...

@3sixty/nameof-vitest-plugin (0.20.0-next.1), @chamfer.run/sdk (>=0.1.0, <=0.5.0) +57 more potentially affected by CVE-2026-112949 via @vitest/mocker (>=5.0.0-beta.1, <=5.0.2)

@vitest/mocker NPM version =5.0.0-beta.1, =0.1.0, =5.0.0-depup.0, =5.0.0-depup.0, =5.0.0-depup.0, =5.0.6, =1.0.2, =1.1.0, =0.0.1-alpha.12, =0.0.1-alpha.3, =1.1.0, =3.2.0, =3.3.0 and more Source cves: CVE-2026-112949 Source advisory: GHSA-QXG6-89MG-RQV8...

@0xshogun/sdk (>=1.0.3, <=1.1.6), @100xsystems/test-suite-typescript (>=0.1.0, <=0.1.2) +1786 more potentially affected by CVE-2026-112949 via @vitest/mocker (>=2.1.0-beta.7, <=4.1.11)

@vitest/mocker NPM version =2.1.0-beta.7, =1.0.3, =0.1.0, =0.0.1, =0.2.4, =0.0.3, =0.2.0, =0.0.1, =0.1.1, =0.1.1, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =0.0.14, =0.0.16 and more Source cves: CVE-2026-112949 Source advisory: GHSA-QXG6-89MG-RQV8...

@aiao/rxdb-test (>=0.0.26, <=0.0.28), @aws/nx-plugin (>=1.0.0-rc.81, <=1.0.11) +61 more potentially affected by CVE-2026-112950 via @vitest/mocker (4.1.11)

@vitest/mocker NPM version 4.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on @vitest/mocker and may be impacted: - @aiao/rxdb-test =0.0.26, =1.0.0-rc.81, =0.1.16, =0.57.0-rslib-esm.2, =6.0.2-rc.52, =0.0.0-1cf62a0, =0.44.0-4, =8.3.14, =11.0.62,...

@3sixty/nameof-vitest-plugin (0.20.0-next.1), @chamfer.run/sdk (>=0.1.0, <=0.5.0) +56 more potentially affected by CVE-2026-112950 via @vitest/mocker (>=5.0.0-rc.2, <=5.0.2)

@vitest/mocker NPM version =5.0.0-rc.2, =0.1.0, =5.0.0-depup.0, =5.0.0-depup.0, =5.0.0-depup.0, =5.0.6, =1.0.2, =1.1.0, =0.0.1-alpha.12, =0.0.1-alpha.3, =1.1.0, =3.2.0, =3.3.0 and more Source cves: CVE-2026-112950 Source advisory: OSV:GHSA-XP26-3454-MJGP...

@3sixty/nameof-vitest-plugin (0.20.0-next.1), @chamfer.run/sdk (>=0.1.0, <=0.5.0) +56 more potentially affected by CVE-2026-112950 via @vitest/mocker (>=5.0.0-rc.2, <=5.0.2)

@vitest/mocker NPM version =5.0.0-rc.2, =0.1.0, =5.0.0-depup.0, =5.0.0-depup.0, =5.0.0-depup.0, =5.0.6, =1.0.2, =1.1.0, =0.0.1-alpha.12, =0.0.1-alpha.3, =1.1.0, =3.2.0, =3.3.0 and more Source cves: CVE-2026-112950 Source advisory: GHSA-XP26-3454-MJGP...

GHSA-XP26-3454-MJGP Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

Summary The path traversal fix released for GHSA-82fw-gwwq-j7x9 can be bypassed on Windows by using a backslash in the redirect URL pathname. The fixed code joins an attacker-controlled URL pathname with the Vite root using node:path/posix, then passes that string to Vite's file allowlist check. ...

@aiao/rxdb-test (>=0.0.26, <=0.0.28), @aws/nx-plugin (>=1.0.0-rc.81, <=1.0.11) +61 more potentially affected by CVE-2026-112950 via @vitest/mocker (4.1.11)

@vitest/mocker NPM version 4.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on @vitest/mocker and may be impacted: - @aiao/rxdb-test =0.0.26, =1.0.0-rc.81, =0.1.16, =0.57.0-rslib-esm.2, =6.0.2-rc.52, =0.0.0-1cf62a0, =0.44.0-4, =8.3.14, =11.0.62,...

Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

Summary The path traversal fix released for GHSA-82fw-gwwq-j7x9 can be bypassed on Windows by using a backslash in the redirect URL pathname. The fixed code joins an attacker-controlled URL pathname with the Vite root using node:path/posix, then passes that string to Vite's file allowlist check. ...

Arbitrary Code Injection

Overview @vitest/mocker is a Vitest module mocker implementation Affected versions of this package are vulnerable to Arbitrary Code Injection via the redirect mock handling in interceptorPlugin.ts and insufficient escaping in createManualModuleSource in utils.ts. In the redirect path, a URL...

@0xshogun/sdk (>=1.0.3, <=1.1.6), @100xsystems/test-suite-typescript (>=0.1.0, <=0.1.2) +1786 more potentially affected by CVE-2026-112949 via @vitest/mocker (>=2.1.0-beta.7, <=4.1.11)

@vitest/mocker NPM version =2.1.0-beta.7, =1.0.3, =0.1.0, =0.0.1, =0.2.4, =0.0.3, =0.2.0, =0.0.1, =0.1.1, =0.1.1, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =0.0.14, =0.0.16 and more Source cves: CVE-2026-112949 Source advisory: SNYK:JS-VITESTMOCKER-21347792...

@aiao/rxdb-test (>=0.0.26, <=0.0.28), @aws/nx-plugin (>=1.0.0-rc.81, <=1.0.11) +61 more potentially affected by CVE-2026-112950 via @vitest/mocker (4.1.11)

@vitest/mocker NPM version 4.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on @vitest/mocker and may be impacted: - @aiao/rxdb-test =0.0.26, =1.0.0-rc.81, =0.1.16, =0.57.0-rslib-esm.2, =6.0.2-rc.52, =0.0.0-1cf62a0, =0.44.0-4, =8.3.14, =11.0.62,...

Directory Traversal

Overview @vitest/mocker is a Vitest module mocker implementation Affected versions of this package are vulnerable to Directory Traversal via the redirect mock handler in interceptorPlugin.ts, where a user-controlled redirect URL with a path-traversal sequence e.g. using backslash separators on...

CVE-2026-112950 Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev...

@3sixty/nameof-vitest-plugin (0.20.0-next.1), @chamfer.run/sdk (>=0.1.0, <=0.5.0) +56 more potentially affected by CVE-2026-112950 via @vitest/mocker (>=5.0.0-rc.2, <=5.0.2)

@vitest/mocker NPM version =5.0.0-rc.2, =0.1.0, =5.0.0-depup.0, =5.0.0-depup.0, =5.0.0-depup.0, =5.0.6, =1.0.2, =1.1.0, =0.0.1-alpha.12, =0.0.1-alpha.3, =1.1.0, =3.2.0, =3.3.0 and more Source cves: CVE-2026-112950 Source advisory: MEND:CVE-2026-112950...