CVE-2026-84373

Name of the Vulnerable Software and Affected Versions Vitest versions 2.1.0 through 4.1.10 Vitest versions 5.0.0-rc.0 through 5.0.0-rc.1

Description The mockerPlugin and interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on the unauthenticated HMR WebSocket. The implementation fails to validate redirect targets against the file-serving allowlist by not enforcing server.fs.allow and server.fs.deny through the isFileLoadingAllowed function. A remote client with access to an exposed development server can submit an opaque URL scheme containing .. segments, causing the path to resolve outside the project root. Consequently, the plugin's load hook returns the content of local files readable by the dev-server process as module source, leading to local file disclosure.

Recommendations Update to version 4.1.11. Update to version 5.0.0-rc.2.