[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vitest (source)	4.1.10 → 4.1.11

---

Vitest: Path Traversal / Arbitrary File Read via @​vitest/mocker Redirect Mock

CVE-2026-84373 / GHSA-82fw-gwwq-j7x9

More information

Details

Summary

@vitest/mocker registers a redirect mock's target path without validating it
against the dev server's file-serving allowlist. An attacker who can reach the
dev server's WebSocket can register a redirect mock pointing outside the project
root; when the mocked module is requested, the plugin's load hook returns
readFile(<attacker path>) as the module source, disclosing local files.

This is exploitable without authentication only through the public
mockerPlugin / standalone interceptorPlugin exports (used by third-party dev
servers), which register the handler on Vite's unauthenticated HMR socket.
Vitest's own browser mode registers mocks over a token-authenticated RPC and
is not remotely reachable by default (see Scope).

Affected code

packages/mocker/src/node/interceptorPlugin.ts.

The load hook is the file-read sink:

if (mock.type === 'redirect') {
  return readFile(mock.redirect, 'utf-8')
}

mock.redirect is derived from client input at registration time with no
boundary check:

if (event.type === 'redirect') {
  const redirectUrl = new URL(event.redirect)
  event.redirect = join(server.config.root, redirectUrl.pathname)
}
registry.register(event)

There is no server.fs.allow / server.fs.deny check and no assertion that the
resolved path stays within the project root.

Registration paths and trust boundaries

• Public mockerPlugin / interceptorPlugin (unauthenticated). In
  configureServer, the plugin registers server.ws.on('vitest:interceptor:register', …)
  on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin
  check, so any client that can reach it can register a redirect mock. This is
  the path the "unauthenticated" impact applies to.
• Vitest browser mode (authenticated). Mocks register over the browser RPC
  (registerMock), which sits behind a per-run token (isValidApiRequest, a
  random api.token). The interceptor's configureServer socket is not used for
  registration here (in v5 it does not run at all, as the plugin is injected per
  environment). The same missing boundary check exists on the authenticated RPC
  path, but reaching it requires the token, so it is not a remote-unauthenticated
  read.

Path handling

new URL(redirect).pathname combined with join(root, pathname) does not
confine reads to the root:

• Special/hierarchical schemes (file:, http:) are normalized by WHATWG URL,
  so .. segments are collapsed and the result stays under the root. Payloads of
  the form file:///../../etc/passwd do not escape.
• A non-special (opaque) scheme preserves .. in pathname, so
  join(root, "../../…/etc/passwd") resolves outside the root and reads an
  arbitrary file.

Even without escaping the root, the missing server.fs check allows reading any
in-root file the dev server would otherwise refuse to serve (for example an
in-root .env or source that is denied by server.fs.deny).

Scope / preconditions

• This is a development-server issue. The dev server binds to localhost by
  default and is not reachable from the network unless the developer exposes it
  (server.host / 0.0.0.0, a LAN bind, or a proxy).
• A raw (non-browser) client against a reachable server bypasses browser origin
  and CORS protections entirely and can both register the mock and read the
  response.
• A browser-based drive-by against a localhost server is substantially mitigated
  by Vite defaults: the default CORS origin allowlist is limited to localhost
  origins, and server.allowedHosts blocks DNS-rebinding, so a cross-origin page
  cannot read the file contents back.

Impact

Disclosure of local files readable by the dev-server process (source, in-root
.env/secrets, and, via the opaque-scheme payload, files outside the project
root). No integrity or availability impact.

Affected versions

Present since @vitest/mocker was introduced.

• Affected: @vitest/mocker >= 2.1.0 (shipped in vitest and
  @vitest/browser >= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.
• Fixed: Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not
  maintained and are not planned to receive the fix.

Fix

Validate the resolved redirect target against Vite's file-serving allowlist
(isFileLoadingAllowed) before registering it, at every registration site, and
stop registering the interceptor WebSocket events in Vitest's browser mode
(mocks there flow through the authenticated RPC).

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9
• https://nvd.nist.gov/vuln/detail/CVE-2026-84373
• https://github.com/vitest-dev/vitest/pull/10972
• https://github.com/vitest-dev/vitest/pull/10974
• https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8
• https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4
• https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f
• https://github.com/vitest-dev/vitest/releases/tag/v4.1.11
• https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2
• https://github.com/advisories/GHSA-82fw-gwwq-j7x9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Vitest: Path Traversal / Arbitrary File Read via @​vitest/mocker Redirect Mock

CVE-2026-84373 / GHSA-82fw-gwwq-j7x9

More information

Details

Summary

@vitest/mocker registers a redirect mock's target path without validating it
against the dev server's file-serving allowlist. An attacker who can reach the
dev server's WebSocket can register a redirect mock pointing outside the project
root; when the mocked module is requested, the plugin's load hook returns
readFile(<attacker path>) as the module source, disclosing local files.

This is exploitable without authentication only through the public
mockerPlugin / standalone interceptorPlugin exports (used by third-party dev
servers), which register the handler on Vite's unauthenticated HMR socket.
Vitest's own browser mode registers mocks over a token-authenticated RPC and
is not remotely reachable by default (see Scope).

Affected code

packages/mocker/src/node/interceptorPlugin.ts.

The load hook is the file-read sink:

if (mock.type === 'redirect') {
  return readFile(mock.redirect, 'utf-8')
}

mock.redirect is derived from client input at registration time with no
boundary check:

if (event.type === 'redirect') {
  const redirectUrl = new URL(event.redirect)
  event.redirect = join(server.config.root, redirectUrl.pathname)
}
registry.register(event)

There is no server.fs.allow / server.fs.deny check and no assertion that the
resolved path stays within the project root.

Registration paths and trust boundaries

• Public mockerPlugin / interceptorPlugin (unauthenticated). In
  configureServer, the plugin registers server.ws.on('vitest:interceptor:register', …)
  on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin
  check, so any client that can reach it can register a redirect mock. This is
  the path the "unauthenticated" impact applies to.
• Vitest browser mode (authenticated). Mocks register over the browser RPC
  (registerMock), which sits behind a per-run token (isValidApiRequest, a
  random api.token). The interceptor's configureServer socket is not used for
  registration here (in v5 it does not run at all, as the plugin is injected per
  environment). The same missing boundary check exists on the authenticated RPC
  path, but reaching it requires the token, so it is not a remote-unauthenticated
  read.

Path handling

new URL(redirect).pathname combined with join(root, pathname) does not
confine reads to the root:

• Special/hierarchical schemes (file:, http:) are normalized by WHATWG URL,
  so .. segments are collapsed and the result stays under the root. Payloads of
  the form file:///../../etc/passwd do not escape.
• A non-special (opaque) scheme preserves .. in pathname, so
  join(root, "../../…/etc/passwd") resolves outside the root and reads an
  arbitrary file.

Even without escaping the root, the missing server.fs check allows reading any
in-root file the dev server would otherwise refuse to serve (for example an
in-root .env or source that is denied by server.fs.deny).

Scope / preconditions

• This is a development-server issue. The dev server binds to localhost by
  default and is not reachable from the network unless the developer exposes it
  (server.host / 0.0.0.0, a LAN bind, or a proxy).
• A raw (non-browser) client against a reachable server bypasses browser origin
  and CORS protections entirely and can both register the mock and read the
  response.
• A browser-based drive-by against a localhost server is substantially mitigated
  by Vite defaults: the default CORS origin allowlist is limited to localhost
  origins, and server.allowedHosts blocks DNS-rebinding, so a cross-origin page
  cannot read the file contents back.

Impact

Disclosure of local files readable by the dev-server process (source, in-root
.env/secrets, and, via the opaque-scheme payload, files outside the project
root). No integrity or availability impact.

Affected versions

Present since @vitest/mocker was introduced.

• Affected: @vitest/mocker >= 2.1.0 (shipped in vitest and
  @vitest/browser >= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.
• Fixed: Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not
  maintained and are not planned to receive the fix.

Fix

Validate the resolved redirect target against Vite's file-serving allowlist
(isFileLoadingAllowed) before registering it, at every registration site, and
stop registering the interceptor WebSocket events in Vitest's browser mode
(mocks there flow through the authenticated RPC).

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9
• https://nvd.nist.gov/vuln/detail/CVE-2026-84373
• https://github.com/vitest-dev/vitest/pull/10972
• https://github.com/vitest-dev/vitest/pull/10974
• https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8
• https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4
• https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f
• https://github.com/vitest-dev/vitest
• https://github.com/vitest-dev/vitest/releases/tag/v4.1.11
• https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vitest-dev/vitest (vitest)

v4.1.11

Compare Source

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in #​10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in #​10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in #​10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in #​10974 (fe5a1)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: @studiometa/eslint-plugin-js-toolkit@4.0.0-alpha.3
npm error Found: @vitest/coverage-v8@4.1.10
npm error node_modules/@vitest/coverage-v8
npm error   dev @vitest/coverage-v8@"4.1.10" from @studiometa/eslint-plugin-js-toolkit@4.0.0-alpha.3
npm error   packages/eslint-plugin
npm error     @studiometa/eslint-plugin-js-toolkit@4.0.0-alpha.3
npm error     node_modules/@studiometa/eslint-plugin-js-toolkit
npm error       workspace packages/eslint-plugin from the root project
npm error
npm error Could not resolve dependency:
npm error peerOptional @vitest/coverage-v8@"4.1.11" from vitest@4.1.11
npm error node_modules/vitest
npm error   dev vitest@"4.1.11" from @studiometa/eslint-plugin-js-toolkit@4.0.0-alpha.3
npm error   packages/eslint-plugin
npm error     @studiometa/eslint-plugin-js-toolkit@4.0.0-alpha.3
npm error     node_modules/@studiometa/eslint-plugin-js-toolkit
npm error       workspace packages/eslint-plugin from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-11-06T00_57_12_266Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-11-06T00_57_12_266Z-debug-0.log

[github-actions]

Code Review

Risk: Low — The dependency update is limited to Vitest package manifests and introduces no blocking issues.

Updates the direct vitest devDependency from 4.1.10 to 4.1.11 in the ESLint plugin and JS toolkit packages. No concrete defects are evident in the provided diff.

Still open from earlier reviews (1 finding):

• packages/js-toolkit/package.json:856 — issue: Regenerate the lockfile for the Vitest security update

---

Review usage: 4,917 in (3,066 cached) / 242 out tokens — $0.0008 (openrouter/openai/gpt-5.6-luna, thinking: low)

Reviewed by @weareikko/code-review v0.11.1 for commit 73861d5.

Previous review runs

Previous run archived 2026-11-02T03:29:49Z

Code Review

Risk: Medium — issues that should be addressed before merge.

1 issue found:

• issue — packages/js-toolkit/package.json:856 — Regenerate the lockfile for the Vitest security update

---

Review usage: 49,718 in (36,417 cached) / 1,371 out tokens — $0.0057 (openrouter/openai/gpt-5.6-luna, thinking: low)

Reviewed by @weareikko/code-review v0.11.1 for commit 18bd599.

Previous run archived 2026-11-02T03:26:44Z

Code Review

Risk: Low — no blocking issues; safe to merge aside from nits.

This MR updates the direct vitest development dependency from 4.1.10 to 4.1.11 in two packages. The companion @vitest/* packages remain at 4.1.10, which can retain the vulnerable @vitest/mocker dependency in the installed dependency graph.

---

Review usage: 8,007 in / 828 out tokens — $0.0030 (openrouter/openai/gpt-5.6-luna, thinking: low)

Reviewed by @weareikko/code-review v0.10.3 for commit 5b1cda7.

Previous run archived 2026-10-15T19:16:30Z

Code Review

Risk: Medium — issues that should be addressed before merge.

Updates the direct vitest development dependency from 4.1.10 to 4.1.11 in two packages. The associated browser packages in packages/js-toolkit remain at 4.1.10, so the patched mocker dependency is not consistently adopted.

1 issue found:

• issue — packages/js-toolkit/package.json:845 — Update all Vitest packages to the patched release

---

Review usage: 27,303 in (15,506 cached) / 1,500 out tokens — $0.0051 (openrouter/openai/gpt-5.6-luna, thinking: low)

Reviewed by @weareikko/code-review v0.10.3 for commit bafb730.

Previous run archived 2026-10-13T15:13:42Z

Code Review

Risk: High — blocking issues remain — resolve them before merge.

This MR updates the direct Vitest development dependency in two workspace packages. The corresponding package-lock entries and related Vitest package versions were not updated.

1 issue found:

• issue (blocking) — packages/eslint-plugin/package.json:38 — Update the lockfile with the Vitest dependency changes

---

Review usage: 37,969 in (25,183 cached) / 1,086 out tokens — $0.0050 (openrouter/openai/gpt-5.6-luna, thinking: low)

Reviewed by @weareikko/code-review v0.9.9 for commit 302f703.

[github-actions]

issue: Regenerate the lockfile for the Vitest security update

package-lock.json still records both workspace vitest dependencies as 4.1.10, resolves vitest and @vitest/mocker at 4.1.10, and pins @vitest/browser/@vitest/browser-playwright peer dependencies to 4.1.10. A clean npm ci therefore does not install the declared 4.1.11 dependency set and can reject the manifest-lockfile mismatch; regenerate the lockfile and update the compatible Vitest packages together.

Confidence: high.

---

_{Reviewed by @weareikko/code-review v0.11.1 for commit 18bd599.}