A path traversal flaw was discovered in the Vitest mocker and interceptor plugins. The code registers an HMR WebSocket handler that does not validate redirect URLs against the server’s file‑serving allowlist. When a remote client submits a URL containing ".." path components, the server resolves the redirect outside the project root and the plugin loads the file content as module source. The result is that an attacker can read any file readable by the dev‑server process, compromising confidentiality of local source code and configuration. The vulnerability is classified as CWE-22 and results in moderate impact denoted by a CVSS score of 5.9.

The issue affects Vitest releases from version 2.1.0 through 4.1.11 and 5.0.0-rc.2. The affected packages are the @vitest/mocker and vitest-dev:vitest repositories. Versions prior to 4.1.11 and 5.0.0-rc.2 are impacted; the problem is present in the public mockerPlugin and interceptorPlugin exports in the packages/mocker/src/node/interceptorPlugin.ts file.

The vulnerability is remotely exploitable as an unauthenticated client can connect to an exposed development server via the Vite HMR WebSocket. The attack path relies on sending a specially crafted redirect URL; no additional authentication is required. The CVSS score of 5.9 indicates moderate severity, and the EPSS score is not available, so the exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog. Because Vitest’s browser mode employs token‑authenticated RPC and is not remotely unauthenticated by default, it mitigates the effect for users running Vitest in browser mode, but the development‑server exposure still presents a risk for typical Vite‑powered test runs.