## Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-112948
- 公開日時: 2026-10-21T19:57:00.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-p458-7748-mcp3)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-p458-7748-mcp3

影響: npm:@vitest/ui >= 5.0.0-beta.6, < 5.0.5 → 5.0.5, npm:@vitest/browser >= 5.0.0-beta.6, < 5.0.5 → 5.0.5, npm:vite-plus >= 1.0.0-rc.0, < 1.3.0 → 1.3.0
Summary In Vitest 5, Vite's server.fs.deny is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as .env, private keys and certificates, .npmrc, and .git) or Vitest's own API token file (.vitest-secret-token) can be read over plain HTTP by a client that can reach the server. In Browser Mode with test.projects, a malicious website can also read .env values through the developer's browser. This only applies when Vitest runs…