Vitest, a testing framework powered by Vite, suffers from an issue in its UI/API server on Windows where the isFileServingAllowed flag is incorrectly used for the /__vitest_attachment__ endpoint. This induces a \\?\\..\\ style path traversal that permits reading files outside the project. Furthermore, the exposed API actions like saveTestFile and rerun can be abused to write test files and run scripts, enabling arbitrary code execution. The vulnerability was addressed in releases 3.2.5 and 4.1.0.

The flaw affects the Vitest development framework from vitest-dev. All installations using versions earlier than 3.2.5 running on Windows are vulnerable. The issue is not present in release 3.2.5 or newer, or 4.1.0 and newer. Users of these older versions should apply the update.

The CVSS score of 9.8 demonstrates a severe level of risk. The EPSS score of 1% indicates that active exploitation attempts are rare but possible. The vulnerability is not listed in the CISA KEV catalog. Attackers need access to the local Vitest UI/API server—typically bound to localhost—to leverage the path traversal and API endpoints. If the server is exposed over a network, the risk increases markedly; a compromised or malicious user could read sensitive files or run code on the host machine.