Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

影響: npm:@vitest/mocker >= 4.1.11, < 4.1.12 → 4.1.12, npm:@vitest/mocker >= 5.0.0-rc.2, < 5.0.3 → 5.0.3

The path traversal fix released for [GHSA-82fw-gwwq-j7x9](https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9) can be bypassed on Windows by using a backslash in the redirect URL pathname. The fixed code joins an attacker-controlled URL pathname with the Vite root using node:path/posix, then passes that string to Vite's file allowlist check. On Windows, a value such as C:/project/root/..\secret.txt retains ..\ during the POSIX join and begins with the allowed ro…

GitHub Advisory Database에서 읽기

2026. 10. 22. 오전 04:48, GitHub Advisory Database에서 "Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js, GitHub. CVE: CVE-2026-112950.