When the Vitest dev server runs on Windows, a client can register a redirect mock that contains a backslash traversal. Because the server’s path handling treats backslashes differently, the POSIX join preserves the backslash, and the subsequent filesystem read interprets it as a path separator. This allows the client to read any file outside the server.fs.allow list that the Vitest process can access, effectively leaking arbitrary files. The vulnerability is a path traversal flaw (CWE‑22).

The affected products are vitest‑dev:vitest and @vitest:mocker. Vulnerable versions include all releases before 4.1.12 and before 5.0.3. The issue was fixed in Vitest 4.1.12 and Vitest 5.0.3, which corrected the path handling logic for Windows backslashes.

The CVSS score of 5.9 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA KEV, suggesting limited known exploitation activity. The attack requires a client to reach the Vite dev server on a Windows machine and provide a malicious redirect mock, typically in a developer or CI environment. If an attacker can control such a client, they can read confidential files from the server filesystem, jeopardizing confidentiality.