chore(monorepo): update dependency vitest to v3.2.6 [security] by renovate[bot] · Pull Request #1537 · suddenlyGiovanni/suddenlygiovanni.dev

renovate · 2026-06-02T01:09:42Z

This PR contains the following updates:

Package	Change	Age	Confidence
vitest (source)	`3.2.4` → `3.2.6`

When Vitest UI server is listening, arbitrary file can be read and executed

CVE-2026-47429 / GHSA-5xrq-8626-4rwp

More information

Details

Summary

Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network.

Impact

Only users that match either of the following conditions are affected:

explicitly exposes the Vitest UI server to the network (using --api.host or api.host config option)
running the Vitest UI or Browser Mode on Windows

Details

The API handler for /__vitest_attachment__ uses the deprecated isFileServingAllowed incorrectly.
https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/ui/node/index.ts#L77
The function expects the passed value to use cleanUrl after the check before file system related operation.
Because of this, it is possible to bypass the check by \\?\\..\\. This is not possible on Linux as Linux errors if a directory named ? does not exist.

A similar problem exists in other places as well.

That said, this isFileServingAllowed check does not actually prevent the API to be abused. Since the API has rerun feature and file write feature, it's possible to run arbitrary script by writing a script as a test file using saveTestFile and running it using rerun. This means exposing the API / Vitest UI is equivalent to giving script execution access.
On the browser mode side, there're readFile / writeFile / saveSnapshotFile. So exposing the browser mode is equivalent to giving file read / write access.

PoC

Run Vitest UI
Get the API token by curl http://localhost:51204/__vitest__/
Run curl "http://localhost:51204/__vitest_attachment__?path=C:\\path\\to\\project\\?\\..\\..\\secret.txt&contentType=text/plain&token=$TOKEN" (TOKEN is the API token)
curl shows the content of secret.txt that is outside the project directory

Mitigations

Vitest now ships two configuration flags, allowWrite and allowExec, that gate the privileged operations exploited by this vulnerability. Both are disabled by default whenever the API server is bound to a non-localhost host, ensuring that exposing the server to the network no longer implicitly grants write or execute capabilities to remote clients.

When these flags are disabled, the UI also enters a read-only mode: in-browser code editing and test file execution are turned off, removing the attack surface that allowed remote code execution. Many Browser Mode features are also disabled, like attachments, artifacts or snapshots. See browser.api.

Users who require the full interactive UI on a networked host must explicitly opt in by setting allowWrite and/or allowExec to true.

Severity

CVSS Score: 9.8 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vitest-dev/vitest (vitest)

`v3.2.6`

Compare Source

`v3.2.5`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-06-02T01:16:34Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 744 in 95302ba

'@babel/helper-optimise-call-expression@7.27.1':

github-actions · 2026-06-02T01:16:43Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-06-02T01:19:15Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-06-08T18:59:37Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-06-08T18:59:50Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-06-08T19:00:30Z

🧹 Starting cleanup of preview environment resources...

github-actions · 2026-06-08T19:00:38Z

✅ Preview environment cleanup success.

Cleanup Status:

Fly App: success
GitHub Environment: success
Container Images: success

github-actions · 2026-06-09T01:20:48Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-06-09T01:22:30Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-06-11T10:58:55Z

🔄 Preview deployment started... Please wait while we deploy your changes!

socket-security · 2026-06-11T10:59:03Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rolldown-vite@7.3.1
	vitest@3.2.6

View full report

socket-security · 2026-06-11T10:59:05Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

github-actions · 2026-06-11T11:00:37Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-06-11T23:06:19Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-06-11T23:06:33Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-07-12T11:32:14Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-07-12T11:32:28Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 6765 in de72918

'@babel/helper-optimise-call-expression': 7.27.1

github-actions · 2026-07-12T11:32:29Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 6778 in de72918

'@babel/helper-optimise-call-expression': 7.27.1

github-actions · 2026-07-12T11:32:29Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 6791 in de72918

'@babel/helper-optimise-call-expression': 7.27.1

github-actions · 2026-07-12T11:32:30Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 6858 in de72918

'@babel/helper-optimise-call-expression@7.27.1':

github-actions · 2026-07-12T11:32:31Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 6868 in de72918

'@babel/helper-optimise-call-expression': 7.27.1

github-actions · 2026-07-12T11:32:32Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 6877 in de72918

'@babel/helper-optimise-call-expression': 7.27.1

github-actions · 2026-07-12T11:32:32Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 6886 in de72918

'@babel/helper-optimise-call-expression': 7.27.1

github-actions · 2026-07-12T11:33:54Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-07-12T19:04:30Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-07-12T19:04:50Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-07-16T17:35:29Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-07-16T17:35:47Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-07-17T10:26:24Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-07-17T10:26:38Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-07-20T19:59:04Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-07-20T20:00:40Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-07-21T04:41:42Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-07-21T04:42:00Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

renovate Bot added the dependencies Pull requests that update a dependency file label Jun 2, 2026

github-actions Bot reviewed Jun 2, 2026

View reviewed changes

renovate Bot changed the title ~~chore(monorepo): update dependency vitest to v4 [security]~~ chore(monorepo): update dependency vitest to v4 [security] - autoclosed Jun 8, 2026

renovate Bot closed this Jun 8, 2026

renovate Bot deleted the renovate/npm-vitest-vulnerability branch June 8, 2026 18:58

renovate Bot deployed to fly-preview-1537 June 8, 2026 19:00 Active

renovate Bot changed the title ~~chore(monorepo): update dependency vitest to v4 [security] - autoclosed~~ chore(monorepo): update dependency vitest to v3.2.6 [security] Jun 9, 2026

renovate Bot reopened this Jun 9, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch 2 times, most recently from 95302ba to 4f3895d Compare June 9, 2026 01:15

renovate Bot had a problem deploying to fly-preview-1537 June 9, 2026 01:15 Error

renovate Bot had a problem deploying to fly-preview-1537 June 9, 2026 01:15 Failure

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 4f3895d to 08b69a3 Compare June 11, 2026 10:58

renovate Bot had a problem deploying to fly-preview-1537 June 11, 2026 10:58 Error

renovate Bot had a problem deploying to fly-preview-1537 June 11, 2026 10:58 Failure

renovate Bot had a problem deploying to fly-preview-1537 June 11, 2026 23:06 Failure

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 08b69a3 to de72918 Compare July 12, 2026 11:31

renovate Bot had a problem deploying to fly-preview-1537 July 12, 2026 11:32 Error

renovate Bot had a problem deploying to fly-preview-1537 July 12, 2026 11:32 Failure

github-actions Bot reviewed Jul 12, 2026

View reviewed changes

renovate Bot had a problem deploying to fly-preview-1537 July 12, 2026 19:04 Failure

renovate Bot had a problem deploying to fly-preview-1537 July 16, 2026 17:35 Failure

renovate Bot had a problem deploying to fly-preview-1537 July 17, 2026 10:26 Failure

chore(monorepo): update dependency vitest to v3.2.6 [security]

62a4157

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from de72918 to 62a4157 Compare July 20, 2026 19:53

renovate Bot had a problem deploying to fly-preview-1537 July 20, 2026 19:53 Error

renovate Bot had a problem deploying to fly-preview-1537 July 20, 2026 19:58 Failure

renovate Bot had a problem deploying to fly-preview-1537 July 21, 2026 04:41 Failure

Conversation

renovate Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

When Vitest UI server is listening, arbitrary file can be read and executed

Details

Summary

Impact

Details

PoC

Mitigations

Severity

References

Release Notes

v3.2.6

v3.2.5

Configuration

Uh oh!

github-actions Bot Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 2, 2026

Uh oh!

github-actions Bot commented Jun 2, 2026

Uh oh!

github-actions Bot commented Jun 8, 2026

Uh oh!

github-actions Bot commented Jun 8, 2026

Uh oh!

github-actions Bot commented Jun 8, 2026

Uh oh!

github-actions Bot commented Jun 8, 2026

Cleanup Status:

Uh oh!

github-actions Bot commented Jun 9, 2026

Uh oh!

github-actions Bot commented Jun 9, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

socket-security Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

github-actions Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

renovate Bot commented Jun 2, 2026 •

edited

Loading

`v3.2.6`

`v3.2.5`

socket-security Bot commented Jun 11, 2026 •

edited

Loading

socket-security Bot commented Jun 11, 2026 •

edited

Loading