Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
影響: npm:@vitest/ui >= 5.0.0-beta.6, < 5.0.5 → 5.0.5, npm:@vitest/browser >= 5.0.0-beta.6, < 5.0.5 → 5.0.5, npm:vite-plus >= 1.0.0-rc.0, < 1.3.0 → 1.3.0
In Vitest 5, Vite's server.fs.deny is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as .env, private keys and certificates, .npmrc, and .git) or Vitest's own API token file (.vitest-secret-token) can be read over plain HTTP by a client that can reach the server. In Browser Mode with test.projects, a malicious website can also read .env values through the developer's browser. This only applies when Vitest runs…
| CVE | CVE-2026-112948 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 22. 오전 05:20 |
| 데이터 | Markdown JSON |
2026. 10. 22. 오전 04:57, GitHub Advisory Database에서 "Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-112948.