https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:29:20.890008+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-339197 EUVD-2026-339197 2026-10-03T12:29:20.947973+00:00 EUVD-2026-339197 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47429 fkie_cve-2026-47429 2026-10-03T12:29:20.948010+00:00

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

 https://cve.radiocsirt.org/vuln/ghsa-5xrq-8626-4rwp GHSA-5xrq-8626-4rwp — When Vitest UI server is listening, arbitrary file can be read and executed 2026-10-03T12:29:20.948044+00:00

Affected: npm: vitest

### Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network.

### Impact Only users that match either of the following conditions are affected:

- explicitly exposes the Vitest UI server to the network (using `--api.host` or [`api.host` config option](https://vitest.dev/config/api.html)) - running the Vitest UI or Browser Mode on Windows

### Details The API handler for `/__vitest_attachment__` uses the deprecated `isFileServingAllowed` incorrectly. https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/ui/node/index.ts#L77 The function expects the passed value to use `cleanUrl` after the check before file system related operation. Because of this, it is possible to bypass the check by `\\?\\..\\`. This is not possible on Linux as Linux errors if a directory named `?` does not exist.

A similar problem exists in other places as well. - https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L103-L105 - https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L119-L121 - https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/commands/fs.ts#L10-L11 - https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/plugin.ts#L194-L196 - https://github.com/vitest-de…

 https://cve.radiocsirt.org/vuln/rhsa-2026:39058 RHSA-2026:39058 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-03T12:29:20.948093+00:00

vitest: Vitest: Arbitrary code execution via crafted browser-runner URL vitest: Vitest: Arbitrary code execution and information disclosure via path traversal