CVE-2026-47429
Vitest, a JavaScript testing framework, had a flaw that let attackers read files outside the project on Windows. The bug also allowed running arbitrary scripts through certain API calls. The issue is fixed in newer releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Vitest versions before 3.2.5 and 4.1.0 on Windows. Developers using Vitest for unit testing.
Real-world impact
An attacker could read any file on the system that the user can access, and could run arbitrary code via the test server’s API, potentially compromising the development machine.
Why this severity
The CVSS score of 9.8 reflects that the flaw can be exploited without authentication, from any network, and can compromise confidentiality, integrity, and availability of the system.
What to do about it
- 01Upgrade Vitest to version 3.2.5 or later (or 4.1.0 or later).
- 02Restart any running Vitest test servers to ensure the new version is in use.
NVD-referenced vendor advisory
Timeline
- Jul 14, 2026 · 19d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 21, 2026 · 12d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.