Answer in brief
CVE-2026-112950 records a Medium severity (CVSS 5.9) vulnerability in Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix. The current sources do not mark it as known exploited. The current feed maps @vitest/mocker (generic), vitest-dev/vitest (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps @vitest/mocker (generic), vitest-dev/vitest (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| @vitest/mockergeneric | >=4.1.11 <4.1.12 || >=5.0.0-rc.2 <5.0.3 | 4.1.12, 5.0.3 |
| vitest-dev/vitestgeneric | >=4.1.11 <4.1.12 || >=5.0.0-rc.2 <5.0.3 | 4.1.12, 5.0.3 |
Published upstream
Oct 20, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 20, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 20, 2026
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.
Quoted source text, attributed separately from HOL analysis.