CVE-2026-112950: Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
The path traversal fix released for GHSA-82fw-gwwq-j7x9 can be bypassed on Windows by using a backslash in the redirect URL pathname.
The fixed code joins an attacker-controlled URL pathname with the Vite root using node:path/posix, then passes that string to Vite’s file allowlist check. On Windows, a value such as C:/project/root/..\secret.txt retains ..\ during the POSIX join and begins with the allowed root, so the allowlist accepts it. The later readFile() call uses Windows filesystem semantics, where the backslash is a path separator, and reads the sibling file outside the configured root.
I reproduced the issue with the published @vitest/mocker packages in both fixed release lines:
@vitest/mocker@4.1.11@vitest/mocker@5.0.0
The current main source at commit 2ce29d5fa758046e5453bd92b8ed6c9da9709bb5 has the same behavior.
References
- github.com/advisories/GHSA-xp26-3454-mjgp
- github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35
- github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473
- github.com/vitest-dev/vitest/releases/tag/v4.1.12
- github.com/vitest-dev/vitest/releases/tag/v5.0.3
- github.com/vitest-dev/vitest/security/advisories/GHSA-xp26-3454-mjgp
- nvd.nist.gov/vuln/detail/CVE-2026-112950
Code Behaviors & Features
Detect and mitigate CVE-2026-112950 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →