{"id":"ghsa-ghsa-xp26-3454-mjgp","seq":53434,"kind":"advisory","title":"Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix","url":"https://github.com/advisories/GHSA-xp26-3454-mjgp","permalink":"https://vulnpulse.app/items/ghsa-ghsa-xp26-3454-mjgp","summary":"影響: npm:@vitest/mocker >= 4.1.11, < 4.1.12 → 4.1.12, npm:@vitest/mocker >= 5.0.0-rc.2, < 5.0.3 → 5.0.3\nSummary The path traversal fix released for [GHSA-82fw-gwwq-j7x9](https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9) can be bypassed on Windows by using a backslash in the redirect URL pathname. The fixed code joins an attacker-controlled URL pathname with the Vite root using node:path/posix, then passes that string to Vite's file allowlist check. On Windows, a value such as C:/project/root/..\\secret.txt retains ..\\ during the POSIX join and begins with the allowed ro…","severity":"medium","techs":["nodejs","github"],"cves":["CVE-2026-112950"],"tags":["GHSA-xp26-3454-mjgp","@vitest/mocker","@vitest/mocker"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T19:48:38.000Z","fetched_at":"2026-10-21T20:20:51.598Z"}