This vulnerability arises from the misapplication of Vitest’s server.fs.deny configuration between versions 5.0.0‑beta.6 and 5.0.5. The defect allows a remote user who can reach an affected UI, Browser Mode, or API server to read files that should have been excluded by the deny rules, including ".env" files, private keys, ".git" directories, and the fallback API token at node_modules/.vitest/.vitest-secret-token. The result is a direct leak of potentially sensitive configuration data, credentials, and source‑control artifacts. The weakness is a typical information‑disclosure flaw (CWE‑200).

The affected components are Vitest’s Browser and UI servers, the vite-plus plugin from vitejs, and the vitest-dev:vitest package. In server‑side tests using Vitest, the vulnerability applies to any project where the server.fs.deny setting is overridden and the kernel falls back to the root server’s default matcher. Version range: any installation of Vitest between 5.0.0‑beta.6 and 5.0.5 inclusive, although the issue also impacts projects using related Vitest packages that rely on the same internal matching logic. Upgrading to version 5.0.5 or newer removes the defect.

The impact is a moderate‑to‑high CVSS score of 6.5, reflecting the severity of the information disclosure. While the EPSS score is not available, the publicly disclosed advisory and the availability of a fix indicate that the exploit is well‑known and could be used by remote attackers who can access the Vitest UI, Browser, or API endpoints. The vulnerability is not currently listed in CISA’s KEV catalog, but the lack of an EPSS figure does not reduce the foundational risk of exposing source‑control data and environment variables to unauthenticated users. Adversaries could leverage the exposed API token or environmental values to achieve further privilege escalation or to compromise downstream deployment pipelines.