Vitest Mocker Flaws Let Attackers Read Files and Inject Code

EXECUTIVE SUMMARY:

Multiple vulnerabilities have been identified in the @vitest/mocker package, affecting its interceptor plugin used by development servers. The flaws can allow unauthenticated clients that can reach the development server to bypass file access controls or inject arbitrary JavaScript into served modules. Overall risk is moderate, with potential for sensitive file disclosure or developer-side code execution in development environments.

CVE-2026-112950 (CVSS 5.9 — Medium): A path traversal flaw in the Vitest mocker package's redirect registration involving node:path/posix allows a Windows backslash sequence to bypass the file allowlist check. An unauthenticated client that can reach the development server can register a redirect and cause the server to read a file outside the intended project root.[emaillocker id="1283"]

CVE-2026-112949 (CVSS 4.7 — Medium): A code injection flaw in the Vitest mocker package's interceptorPlugin manual mock registration accepts unauthenticated WebSocket messages and interpolates an attacker-controlled module reference into generated JavaScript without escaping. A client that can reach the development server can replace a served module with arbitrary JavaScript that executes in the developer's browser on the development server origin.

RECOMMENDATION:

We recommend you to update @vitest/mocker to version 4.1.12 or 5.0.3 or later.

REFERENCES:

The following reports contain further technical details:

• https://github.com/advisories/GHSA-qxg6-89mg-rqv8
• https://github.com/advisories/GHSA-xp26-3454-mjgp