CVE-2026-84373: 
JavaScript vulnerability analysis and mitigation

CVE-2026-84373 is a path traversal / arbitrary file read vulnerability in the @vitest/mocker package of the Vitest testing framework. The flaw exists in versions >= 2.1.0, < 4.1.11 and >= 5.0.0-beta.1, < 5.0.0-rc.2 of both vitest and @vitest/mocker. It was disclosed on September 1, 2026, with the GitHub Security Advisory (GHSA-82fw-gwwq-j7x9) published on September 8, 2026. The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper path validation (CWE-22 — Path Traversal) in packages/mocker/src/node/interceptorPlugin.ts. The mockerPlugin and interceptorPlugin exports register a vitest:interceptor:register event handler on Vite's HMR WebSocket, which performs no authentication, token, or origin validation. When a redirect-type mock event is received, the code executes join(server.config.root, new URL(event.redirect).pathname) without subsequently calling isFileLoadingAllowed() to validate the resolved path against server.fs.allow / server.fs.deny. Because WHATWG URL parsing of a non-special (opaque) URL scheme (e.g., traversal:../secret.txt) preserves .. segments in the pathname, the join() call can resolve to a path outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing arbitrary local files readable by the dev-server process (GitHub Advisory, Fix PR #10972).

Successful exploitation results in disclosure of local files readable by the Vite dev-server process, including in-project source files, .env files containing secrets, and — via the opaque-scheme path traversal payload — files entirely outside the project root (e.g., /etc/passwd, SSH keys, or credential files). There is no integrity or availability impact; the vulnerability is purely a confidentiality breach. The scope is limited to development environments where the dev server is reachable from an untrusted network (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory date. The EPSS score is approximately 0.375%, indicating low near-term exploitation probability. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement that the attacker must be able to reach an exposed development server. The vulnerability is not listed in the CISA KEV catalog. Exploitation without authentication is only possible via the public mockerPlugin/interceptorPlugin path on an exposed dev server; Vitest's own browser mode uses a token-authenticated RPC and is not directly affected (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify an exposed Vitest/Vite development server (running vitest or a third-party dev server using mockerPlugin/interceptorPlugin) that is network-accessible — e.g., bound to 0.0.0.0 or a LAN interface rather than the default localhost.
2. Establish WebSocket connection: Connect directly to the Vite HMR WebSocket endpoint (e.g., ws://<target>:<port>) using a raw WebSocket client (e.g., the ws Node.js library or websocat), bypassing browser CORS restrictions entirely.
3. Register a malicious redirect mock: Send a crafted vitest:interceptor:register event with a redirect value using an opaque URL scheme that preserves .. segments, pointing outside the project root:

   {
     "type": "custom",
     "event": "vitest:interceptor:register",
     "data": {
       "type": "redirect",
       "raw": "",
       "id": "/mock",
       "url": "/mock",
       "redirect": "traversal:../../../etc/passwd"
     }
   }

4. Trigger module load: Request the mocked module ID from the dev server (e.g., via an HTTP GET to http://<target>:<port>/mock or by triggering a module transform request), causing the plugin's load hook to execute readFile(mock.redirect, 'utf-8').
5. Retrieve file contents: The server returns the contents of the targeted file as JavaScript module source in the HTTP response, disclosing the file to the attacker (GitHub Advisory, Fix Commit).

• Network: Unexpected WebSocket connections to the Vite HMR port (default: 5173) from non-localhost IP addresses; raw WebSocket clients (not browsers) connecting to the HMR socket.
• Network: HTTP requests to module paths (e.g., /mock) immediately following a WebSocket vitest:interceptor:register event from an external client.
• Logs: Vite dev-server logs showing vitest:interceptor:register events originating from unexpected remote addresses.
• Logs: File read errors or unexpected module transform responses for paths outside the project root (e.g., /etc/passwd, ~/.ssh/id_rsa) appearing in server logs.
• Process: The Node.js dev-server process reading files outside the project directory, observable via filesystem audit tools (e.g., auditd, inotifywait, or fs_usage on macOS).

Upgrade to Vitest 4.1.11 or 5.0.0-rc.2 (or later), which validate redirect mock targets against Vite's isFileLoadingAllowed() before registration and disable unauthenticated WebSocket mock registration in browser mode (Fix PR #10972, Fix PR #10974). Older major versions (2.x, 3.x) are not maintained and will not receive patches. As an immediate workaround, ensure the Vite dev server is bound only to localhost (the default) and is not exposed to untrusted networks via server.host, reverse proxies, or tunnels. Additionally, configure server.fs.allow to the minimum required set of directories and use server.fs.deny to explicitly block sensitive paths.

The fix was authored and merged by Vitest maintainer sheremet-va on August 17, 2026, with the security advisory formally published on September 8, 2026 (GitHub Advisory). The issue was classified as "Moderate" severity by the Vitest project. No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory and patch PRs.