CVE-2026-47429Patch(vitest.dev / vitest)

LOWCVSS 5.9 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch vitest.dev vitest systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

vitest.dev CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

vitest

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
9 mentions across 5 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 6 signals
Technical details provided in 7 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 3d ago at 4 mentions (2026-06-05); latest day: 1
9 total mentions across 5 days

Affected systems

Vendors

vitest.dev

Products

vitest

Deep dive

Activity timeline9 mentions / 5d

Signal classification3 categories

Patch

555.6%

Disclosure

333.3%

General

111.1%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-01	1	Disclosure1
2026-06-05	4	General1Patch3
2026-06-06	1	Disclosure1
2026-06-07	2	Disclosure1Patch1
2026-07-16	1	Patch1

Full discourse9 posts

yousukezan@yousukezan133d
Patch
Vitest RCE脆弱性（CVE-2026-47429ほか）｜影響バージョンの確認・パッチ適用・SCA検知の手順 https://ai-heartland.com/security/vitest-rce-cve-2026-47429/
Post summary
The text announces a Remote Code Execution vulnerability in Vitest (CVE‑2026‑47429), lists affected versions, and provides patch and detection guidance to mitigate the issue.
0201352.8K
14.5K followersView on X
AI Heartland@peaks2314133d
Patch
Vitest RCE脆弱性（CVE-2026-47429ほか）｜影響バージョンの確認・パッチ適用・SCA検知の手順 https://ai-heartland.com/security/vitest-rce-cve-2026-47429/
Post summary
The text announces a Vitest RCE vulnerability (CVE-2026-47429) and provides guidance on verifying affected versions and applying patches, with no evidence of PoC, exploit code, or active exploitation.
010150750
3.4K followersView on X
ode@odetarou133d
Patch
VitestのRCE脆弱性（CVE-2026-47429）を社内共有すべきか調べたけど ChromeがLocal Network Access：LNA（旧PNA）で守ってくれるから多分大丈夫そう。外部サイトからlocalhostへのSimple Requestが送れる時代があったのは怖い。 WebSocketのLNA対応はChrome147でつい最近 https://gemini.google.com/share/88fd92a0f5fa
Post summary
The post notes CVE‑2026‑47429 and claims Chrome’s LNA (WebSocket support added in v147) mitigates the RCE, implying no urgent internal dissemination.
00030149
180 followersView on X
AI Heartland@peaks2314133d
General
@yousukezan https://ai-heartland.com/security/vitest-rce-cve-2026-47429/
Post summary
The tweet merely links to a page about CVE‑2026‑47429 without providing additional context or details.
000203.4K
3.4K followersView on X
SecAlerts@SecAlertsCo131d
Disclosure
Critical 9.8: CVE-2026-47429 in Vitest (npm) allows arbitrary file read on Windows when the UI server is network-exposed. No auth, no interaction needed. Check your dev/CI environments now. #vitest #security https://secalerts.co/vulnerability/CVE-2026-47429 https://t.co/pGeeDiEbsz
Post summary
The tweet announces a critical file-read vulnerability (CVE‑2026‑47429) in Vitest’s UI server when exposed to a network, highlighting the lack of authentication and recommending checks in dev/CI environments.
0100097
831 followersView on X
VulniPulse@vulnipulse92d
Patch
⚠️ Linux prometheus3-13 alert: CVE-2026-47429 (CVSS 8.1) Attackers could execute arbitrary code. Upgrade to a vendor-listed fixed release. https://vulnipulse.com/advisories/linux-cve-2026-47429 #Linux #prometheus313 #RCE #CyberSecurity #CVE
Post summary
The advisory alerts that CVE‑2026‑47429 allows remote code execution (RCE) and advises users to upgrade to the vendor‑issued fixed release.
0000048
6 followersView on X
セキュリティ対策Lab@securityLab_jp130d
Disclosure
JavaScript テストフレームワーク Vitestに重大な脆弱性(VE-2026-47428,CVE-2026-47429,CVE未採番) https://rocket-boys.co.jp/security-measures-lab/vitest-cve-2026-47429-remote-code-execution/ #セキュリティ対策Lab #security #securitynews
Post summary
The text announces a serious remote code execution vulnerability in the JavaScript test framework Vitest, identified by CVE‑2026‑47429, with further details available at the provided link.
00000188
419 followersView on X
ほっすぃ@hossuii131d
Patch
Vitest RCE脆弱性（CVE-2026-47429ほか）｜影響バージョンの確認・パッチ適用・SCA検知の手順 https://ai-heartland.com/security/vitest-rce-cve-2026-47429/
Post summary
The article discusses verifying affected Vitest versions and applying patches for the RCE vulnerability CVE-2026-47429, providing remediation guidance.
00000127
7.8K followersView on X
Upwind Security MDR@UpwindMDR137d
Disclosure
🚨 Critical - Vitest UI Server Exposure Can Lead to Arbitrary File Read and Code Execution (CVE-2026-47429) A flaw in Vitest's UI/API server on Windows allows remote attackers to bypass file access restrictions and read arbitrary files when the server is exposed to the network. The exposed API can also be abused to write files and execute arbitrary scripts. 👉 Affected: Vitest < 4.1.0 (Windows deployments exposing the UI/API server) 👉 Fix: Upgrade to Vitest 4.1.0 or later
Post summary
The post announces a critical vulnerability in Vitest’s UI/API server on Windows (CVE‑2026‑47429) that permits arbitrary file reads and code execution, and advises upgrading to version 4.1.0 or newer.
00000119
197 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	vitest.dev	vitest	-	node.js	-

Explore more

Back to dashboard vitest.dev CVEs vitest vulnerabilities

What researchers are saying

CVE-2026-47429

yousukezan[verified]@yousukezanPatch

The text announces a Remote Code Execution vulnerability in Vitest (CVE‑2026‑47429), lists affected versions, and provides patch and detection guidance to mitigate the issue.

AI Heartland[verified]@peaks2314Patch

The text announces a Vitest RCE vulnerability (CVE-2026-47429) and provides guidance on verifying affected versions and applying patches, with no evidence of PoC, exploit code, or active exploitation.

AI Heartland[verified]@peaks2314General

The tweet merely links to a page about CVE‑2026‑47429 without providing additional context or details.

VulniPulse[verified]@vulnipulsePatch

The advisory alerts that CVE‑2026‑47429 allows remote code execution (RCE) and advises users to upgrade to the vendor‑issued fixed release.

セキュリティ対策Lab[verified]@securityLab_jpDisclosure

The text announces a serious remote code execution vulnerability in the JavaScript test framework Vitest, identified by CVE‑2026‑47429, with further details available at the provided link.

Upwind Security MDR[verified]@UpwindMDRDisclosure

The post announces a critical vulnerability in Vitest’s UI/API server on Windows (CVE‑2026‑47429) that permits arbitrary file reads and code execution, and advises upgrading to version 4.1.0 or newer.

ode@odetarouPatch

The post notes CVE‑2026‑47429 and claims Chrome’s LNA (WebSocket support added in v147) mitigates the RCE, implying no urgent internal dissemination.

SecAlerts@SecAlertsCoDisclosure

The tweet announces a critical file-read vulnerability (CVE‑2026‑47429) in Vitest’s UI server when exposed to a network, highlighting the lack of authentication and recommending checks in dev/CI environments.