Skip to content

Update dependency vitest to v4 [SECURITY] - #97

Closed
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-vitest-vulnerability
Closed

Update dependency vitest to v4 [SECURITY]#97
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-vitest-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
vitest (source) ^3.2.7 → ^4.0.0 age confidence

Vitest: Path Traversal / Arbitrary File Read via @​vitest/mocker Redirect Mock

CVE-2026-84373 / GHSA-82fw-gwwq-j7x9

More information

Details

Summary

@vitest/mocker registers a redirect mock's target path without validating it
against the dev server's file-serving allowlist. An attacker who can reach the
dev server's WebSocket can register a redirect mock pointing outside the project
root; when the mocked module is requested, the plugin's load hook returns
readFile(<attacker path>) as the module source, disclosing local files.

This is exploitable without authentication only through the public
mockerPlugin / standalone interceptorPlugin exports (used by third-party dev
servers), which register the handler on Vite's unauthenticated HMR socket.
Vitest's own browser mode registers mocks over a token-authenticated RPC and
is not remotely reachable by default (see Scope).

Affected code

packages/mocker/src/node/interceptorPlugin.ts.

The load hook is the file-read sink:

if (mock.type === 'redirect') {
  return readFile(mock.redirect, 'utf-8')
}

mock.redirect is derived from client input at registration time with no
boundary check:

if (event.type === 'redirect') {
  const redirectUrl = new URL(event.redirect)
  event.redirect = join(server.config.root, redirectUrl.pathname)
}
registry.register(event)

There is no server.fs.allow / server.fs.deny check and no assertion that the
resolved path stays within the project root.

Registration paths and trust boundaries
  • Public mockerPlugin / interceptorPlugin (unauthenticated). In
    configureServer, the plugin registers server.ws.on('vitest:interceptor:register', …)
    on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin
    check, so any client that can reach it can register a redirect mock. This is
    the path the "unauthenticated" impact applies to.
  • Vitest browser mode (authenticated). Mocks register over the browser RPC
    (registerMock), which sits behind a per-run token (isValidApiRequest, a
    random api.token). The interceptor's configureServer socket is not used for
    registration here (in v5 it does not run at all, as the plugin is injected per
    environment). The same missing boundary check exists on the authenticated RPC
    path, but reaching it requires the token, so it is not a remote-unauthenticated
    read.
Path handling

new URL(redirect).pathname combined with join(root, pathname) does not
confine reads to the root:

  • Special/hierarchical schemes (file:, http:) are normalized by WHATWG URL,
    so .. segments are collapsed and the result stays under the root. Payloads of
    the form file:///../../etc/passwd do not escape.
  • A non-special (opaque) scheme preserves .. in pathname, so
    join(root, "../../…/etc/passwd") resolves outside the root and reads an
    arbitrary file.

Even without escaping the root, the missing server.fs check allows reading any
in-root file the dev server would otherwise refuse to serve (for example an
in-root .env or source that is denied by server.fs.deny).

Scope / preconditions
  • This is a development-server issue. The dev server binds to localhost by
    default and is not reachable from the network unless the developer exposes it
    (server.host / 0.0.0.0, a LAN bind, or a proxy).
  • A raw (non-browser) client against a reachable server bypasses browser origin
    and CORS protections entirely and can both register the mock and read the
    response.
  • A browser-based drive-by against a localhost server is substantially mitigated
    by Vite defaults: the default CORS origin allowlist is limited to localhost
    origins, and server.allowedHosts blocks DNS-rebinding, so a cross-origin page
    cannot read the file contents back.
Impact

Disclosure of local files readable by the dev-server process (source, in-root
.env/secrets, and, via the opaque-scheme payload, files outside the project
root). No integrity or availability impact.

Affected versions

Present since @vitest/mocker was introduced.

  • Affected: @vitest/mocker >= 2.1.0 (shipped in vitest and
    @vitest/browser >= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.
  • Fixed: Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not
    maintained and are not planned to receive the fix.
Fix

Validate the resolved redirect target against Vite's file-serving allowlist
(isFileLoadingAllowed) before registering it, at every registration site, and
stop registering the interceptor WebSocket events in Vitest's browser mode
(mocks there flow through the authenticated RPC).

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Vitest: Path Traversal / Arbitrary File Read via @​vitest/mocker Redirect Mock

CVE-2026-84373 / GHSA-82fw-gwwq-j7x9

More information

Details

Summary

@vitest/mocker registers a redirect mock's target path without validating it
against the dev server's file-serving allowlist. An attacker who can reach the
dev server's WebSocket can register a redirect mock pointing outside the project
root; when the mocked module is requested, the plugin's load hook returns
readFile(<attacker path>) as the module source, disclosing local files.

This is exploitable without authentication only through the public
mockerPlugin / standalone interceptorPlugin exports (used by third-party dev
servers), which register the handler on Vite's unauthenticated HMR socket.
Vitest's own browser mode registers mocks over a token-authenticated RPC and
is not remotely reachable by default (see Scope).

Affected code

packages/mocker/src/node/interceptorPlugin.ts.

The load hook is the file-read sink:

if (mock.type === 'redirect') {
  return readFile(mock.redirect, 'utf-8')
}

mock.redirect is derived from client input at registration time with no
boundary check:

if (event.type === 'redirect') {
  const redirectUrl = new URL(event.redirect)
  event.redirect = join(server.config.root, redirectUrl.pathname)
}
registry.register(event)

There is no server.fs.allow / server.fs.deny check and no assertion that the
resolved path stays within the project root.

Registration paths and trust boundaries
  • Public mockerPlugin / interceptorPlugin (unauthenticated). In
    configureServer, the plugin registers server.ws.on('vitest:interceptor:register', …)
    on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin
    check, so any client that can reach it can register a redirect mock. This is
    the path the "unauthenticated" impact applies to.
  • Vitest browser mode (authenticated). Mocks register over the browser RPC
    (registerMock), which sits behind a per-run token (isValidApiRequest, a
    random api.token). The interceptor's configureServer socket is not used for
    registration here (in v5 it does not run at all, as the plugin is injected per
    environment). The same missing boundary check exists on the authenticated RPC
    path, but reaching it requires the token, so it is not a remote-unauthenticated
    read.
Path handling

new URL(redirect).pathname combined with join(root, pathname) does not
confine reads to the root:

  • Special/hierarchical schemes (file:, http:) are normalized by WHATWG URL,
    so .. segments are collapsed and the result stays under the root. Payloads of
    the form file:///../../etc/passwd do not escape.
  • A non-special (opaque) scheme preserves .. in pathname, so
    join(root, "../../…/etc/passwd") resolves outside the root and reads an
    arbitrary file.

Even without escaping the root, the missing server.fs check allows reading any
in-root file the dev server would otherwise refuse to serve (for example an
in-root .env or source that is denied by server.fs.deny).

Scope / preconditions
  • This is a development-server issue. The dev server binds to localhost by
    default and is not reachable from the network unless the developer exposes it
    (server.host / 0.0.0.0, a LAN bind, or a proxy).
  • A raw (non-browser) client against a reachable server bypasses browser origin
    and CORS protections entirely and can both register the mock and read the
    response.
  • A browser-based drive-by against a localhost server is substantially mitigated
    by Vite defaults: the default CORS origin allowlist is limited to localhost
    origins, and server.allowedHosts blocks DNS-rebinding, so a cross-origin page
    cannot read the file contents back.
Impact

Disclosure of local files readable by the dev-server process (source, in-root
.env/secrets, and, via the opaque-scheme payload, files outside the project
root). No integrity or availability impact.

Affected versions

Present since @vitest/mocker was introduced.

  • Affected: @vitest/mocker >= 2.1.0 (shipped in vitest and
    @vitest/browser >= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.
  • Fixed: Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not
    maintained and are not planned to receive the fix.
Fix

Validate the resolved redirect target against Vite's file-serving allowlist
(isFileLoadingAllowed) before registering it, at every registration site, and
stop registering the interceptor WebSocket events in Vitest's browser mode
(mocks there flow through the authenticated RPC).

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vitest-dev/vitest (vitest)

v4.1.11

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v4.1.10

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v4.1.9

Compare Source

🐞 Bug Fixes
  • Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #​10546 (a5180)
  • browser:
    • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #​10555 (7fb29)
    • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #​10497 and #​10556 (fbc62)
  • mocker:
    • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #​10548 (2c955)
  • pool:
    • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #​10543 and #​10564 (934b0)
View changes on GitHub

v4.1.8

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v4.1.7

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v4.1.6

Compare Source

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v4.1.5

Compare Source

   🚀 Experimental Features
   🐞 Bug Fixes
    View changes on GitHub

v4.1.4

Compare Source

   🚀 Experimental Features
   🐞 Bug Fixes
    View changes on GitHub

v4.1.3

Compare Source

   🚀 Experimental Features
   🐞 Bug Fixes
    View changes on GitHub

v4.1.2

Compare Source

This release bumps Vitest's flatted version and removes version pinning to resolve flatted's CVE related issues (#​9975).

   🐞 Bug Fixes
    View changes on GitHub

v4.1.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v4.1.0

Compare Source

Vitest 4.1 is out!

This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our blog post.

   🚀 Features

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Paris)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner September 9, 2026 13:22
@renovate
renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch 2 times, most recently from 25d34e1 to 16e062d Compare September 20, 2026 03:53
@renovate
renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 16e062d to 03f84bc Compare October 3, 2026 07:11
@renovate
renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 03f84bc to 9f2f96b Compare October 16, 2026 20:58
@gitar-bot

gitar-bot Bot commented Oct 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Code Review ⚠️ Changes requested 0 closed / 1 findings

🟡 Medium risk · Upgrading Vitest from v3 to v4 changes the test runner and could disrupt test execution or CI behavior through compatibility regressions.

Bumps vitest from v3 to v4 (with the security fix in 4.1.11+), but the change requires an open fix before merge. The arrow-function constructor mocks in __tests__/auth.test.ts and __tests__/credential-setup.test.ts will throw <anonymous> is not a constructor under Vitest 4, breaking every test that reaches getCognitoCredentials. Switch these vi.fn().mockImplementation mocks to function expressions in both test files.

⚠️ Bug: Arrow-function constructor mocks will throw under Vitest 4

📄 package.json:22

src/auth.ts:61,65,79 calls new CognitoIdentityClient(...), new GetIdCommand(...) and new GetCredentialsForIdentityCommand(...). Both __tests__/auth.test.ts:14-16 and __tests__/credential-setup.test.ts:30-32 mock these as vi.fn().mockImplementation(() => ...). In Vitest 4, a mock called with new builds an instance instead of calling mock.apply, so the implementation must use the function or class keyword. With an arrow function you get <anonymous> is not a constructor (Vitest 4 migration guide). Every test that reaches getCognitoCredentials will therefore fail with a TypeError after this bump (lockfile resolves vitest 4.1.12), and the PR ships no test changes. Fix: switch these mock implementations to function expressions, as in the suggestion, in both test files.

auth.test.ts: use constructable `function` implementations (apply the same change in credential-setup.test.ts, returning `input` for the command mocks) 
CognitoIdentityClient: vi.fn().mockImplementation(function () { return { send: sendMock }; }),
GetIdCommand: vi.fn().mockImplementation(function (input) { return { input, _type: 'GetId' }; }),
GetCredentialsForIdentityCommand: vi.fn().mockImplementation(function (input) { return { input, _type: 'GetCreds' }; }),
🤖 Prompt for agents 
Code Review: Bumps vitest from v3 to v4 (with the security fix in 4.1.11+), but the change requires an open fix before merge. The arrow-function constructor mocks in `__tests__/auth.test.ts` and `__tests__/credential-setup.test.ts` will throw `<anonymous> is not a constructor` under Vitest 4, breaking every test that reaches `getCognitoCredentials`. Switch these `vi.fn().mockImplementation` mocks to `function` expressions in both test files.

1. ⚠️ Bug: Arrow-function constructor mocks will throw under Vitest 4
   Files: package.json:22

   `src/auth.ts:61,65,79` calls `new CognitoIdentityClient(...)`, `new GetIdCommand(...)` and `new GetCredentialsForIdentityCommand(...)`. Both `__tests__/auth.test.ts:14-16` and `__tests__/credential-setup.test.ts:30-32` mock these as `vi.fn().mockImplementation(() => ...)`. In Vitest 4, a mock called with `new` builds an instance instead of calling `mock.apply`, so the implementation must use the `function` or `class` keyword. With an arrow function you get `<anonymous> is not a constructor` ([Vitest 4 migration guide](https://v4.vitest.dev/guide/migration)). Every test that reaches `getCognitoCredentials` will therefore fail with a TypeError after this bump (lockfile resolves vitest 4.1.12), and the PR ships no test changes. Fix: switch these mock implementations to `function` expressions, as in the suggestion, in both test files.

   Fix (auth.test.ts: use constructable `function` implementations (apply the same change in credential-setup.test.ts, returning `input` for the command mocks)):
   CognitoIdentityClient: vi.fn().mockImplementation(function () { return { send: sendMock }; }),
   GetIdCommand: vi.fn().mockImplementation(function (input) { return { input, _type: 'GetId' }; }),
   GetCredentialsForIdentityCommand: vi.fn().mockImplementation(function (input) { return { input, _type: 'GetCreds' }; }),
Verification Rules 2/2 met

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Auto-approval Not enabled

Set up

For more verification details, comment gitar display:verbose.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.
Unblock → Override a blocking verdict and allow merging.

Comment with these commands to change the behavior for this request:

Auto-apply Compact Unblock 
gitar auto-apply:on         

gitar display:verbose         

gitar unblock

Was this helpful? React with 👍 / 👎 | Gitar

gitar-bot[bot]
gitar-bot Bot reviewed Oct 16, 2026
View reviewed changes
Comment thread package.json
"@vercel/ncc": "^0.38.3",
"typescript": "^5.7.0",
"vitest": "^3.2.7"
"vitest": "^4.0.0"

@gitar-bot gitar-bot Bot Oct 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Bug: Arrow-function constructor mocks will throw under Vitest 4

src/auth.ts:61,65,79 calls new CognitoIdentityClient(...), new GetIdCommand(...) and new GetCredentialsForIdentityCommand(...). Both __tests__/auth.test.ts:14-16 and __tests__/credential-setup.test.ts:30-32 mock these as vi.fn().mockImplementation(() => ...). In Vitest 4, a mock called with new builds an instance instead of calling mock.apply, so the implementation must use the function or class keyword. With an arrow function you get <anonymous> is not a constructor (Vitest 4 migration guide). Every test that reaches getCognitoCredentials will therefore fail with a TypeError after this bump (lockfile resolves vitest 4.1.12), and the PR ships no test changes. Fix: switch these mock implementations to function expressions, as in the suggestion, in both test files.

auth.test.ts: use constructable function implementations (apply the same change in credential-setup.test.ts, returning input for the command mocks):

CognitoIdentityClient: vi.fn().mockImplementation(function () { return { send: sendMock }; }),
GetIdCommand: vi.fn().mockImplementation(function (input) { return { input, _type: 'GetId' }; }),
GetCredentialsForIdentityCommand: vi.fn().mockImplementation(function (input) { return { input, _type: 'GetCreds' }; }),

Was this helpful? React with 👍 / 👎

@gitar-bot gitar-bot Bot mentioned this pull request Oct 16, 2026
Closed
1 task
@renovate
renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 9f2f96b to 3f63b4a Compare October 27, 2026 14:54
@sonarqubecloud

sonarqubecloud Bot commented Oct 27, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@sonarqube-cloud-us

sonarqube-cloud-us Bot commented Oct 27, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@sonar-platform-bot

sonar-platform-bot Bot commented Oct 27, 2026

Copy link
Copy Markdown

This pull request is being closed because it has been identified as stale.

@renovate

renovate Bot commented Oct 27, 2026

Copy link
Copy Markdown
Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 4.x releases. But if you manually upgrade to 4.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate
renovate Bot deleted the renovate/npm-vitest-vulnerability branch October 27, 2026 16:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gitar-bot gitar-bot[bot] gitar-bot[bot] left review comments

Assignees

No one assigned

Labels

dependencies security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants