{"action":"Upgrade vitest to 3.2.6 or later.","affected":[{"fixed":"4.1.0","introduced":"4.0.0"},{"fixed":"3.2.6","introduced":"0"}],"component":"vitest","cve_ids":["CVE-2026-47429"],"ecosystem":"npm","epss":0.00876,"exploited":false,"fixed_versions":["4.1.0","3.2.6"],"ghsa_id":"GHSA-5xrq-8626-4rwp","id":"tcs_01M5KF5322DJ0XVDTCB3HFBZN0","modified_at":"2026-09-10T03:50:48.501520322Z","published_at":"2026-06-01T14:09:53Z","references":["https://osv.dev/vulnerability/GHSA-5xrq-8626-4rwp","https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp","https://nvd.nist.gov/vuln/detail/CVE-2026-47429","https://github.com/vitest-dev/vitest/pull/10445","https://github.com/vitest-dev/vitest/pull/9350","https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d","https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8","https://github.com/vitest-dev/vitest","https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/commands/fs.ts#L10-L11","https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/plugin.ts#L194-L196","https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/rpc.ts#L115-L121","https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/ui/node/index.ts#L77","https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L103-L105","https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L119-L121","https://github.com/vitest-dev/vitest/releases/tag/v3.2.5","https://github.com/vitest-dev/vitest/releases/tag/v4.1.0"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-5xrq-8626-4rwp","url":"https://osv.dev/vulnerability/GHSA-5xrq-8626-4rwp"}],"summary":"When Vitest UI server is listening, arbitrary file can be read and executed"}