@vitest ui vulnerabilities (CVE)

CVE records published for @vitest ui, newest first. Follow to get an email when a new one appears.

1 results

6.5Medium

CVE-2026-112948 25 days ago

Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

vitest-dev vitest; @vitest browser; @vitest ui; vitejs vite-plus

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An atta…