# When Vitest UI server is listening, arbitrary file can be read and executed

Vitest UI/API server mishandles isFileServingAllowed, letting a remote client path-traverse to read arbitrary files and write/rerun test files for code execution.

- Payout: Research
- Severity: critical
- Program: Vitest
- Found by: sapphi-red, qispark, joevin-slq-docto, koteswar-k
- Disclosed: 2026-06-01
- CVE: CVE-2026-47429
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-5xrq-8626-4rwp
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-5xrq-8626-4rwp
- Tags: area:web domain:oss domain:web impact:data-leak impact:rce kind:research platform:ghsa sev:critical tech:nodejs technique:source-review vuln:access-control vuln:path-traversal vuln:rce

**Target:** Vitest UI/API HTTP server (__vitest_attachment__ endpoint, browser mode RPC)
**Root cause:** The /__vitest_attachment__ handler passes the raw path to isFileServingAllowed but performs the file operation on the un-cleaned URL, so a `\?\..\` segment bypasses the directory restriction on Windows. Separately, privileged API operations (saveTestFile, rerun, readFile/writeFile) lack authorization gating.
**Steps:**
1. Run Vitest UI (server listening on 51204).
2. Fetch API token: `curl http://localhost:51204/__vitest__/`.
3. Request `curl "http://localhost:51204/__vitest_attachment__?path=C:\\path\\to\\project\\?\\..\\..\\secret.txt&contentType=text/plain&token=$TOKEN"`.
4. Response returns contents of secret.txt outside the project directory.
**How found:** Reporter noticed the deprecated isFileServingAllowed was used without applying cleanUrl before the filesystem operation, then tried a `\?\..\` segment that bypasses the check on Windows (Linux fails since directory `?` doesn't exist). Same pattern found in several other call sites.
**Exploitation:** Attacker with network access to the Vitest UI/API server obtains the API token from /__vitest__/, then uses the path traversal to read arbitrary files. Because the API also exposes saveTestFile and rerun, the attacker can write a malicious test file and trigger rerun to execute arbitrary scripts; browser mode exposes readFile/writeFile/saveSnapshotFile for file read/write.
**Escalation:** File read via traversal chains to arbitrary code execution by writing a test file with saveTestFile and invoking rerun; browser mode extends to full file read/write.
**Insight:** When a path allowlist check and the actual file operation consume different representations of the URL, look for separators/segments the check normalizes away but the OS resolves (e.g. Windows `?` and backslashes); also audit whether privileged API endpoints (write/exec) are gated at all, since a read-only traversal can chain to RCE.

## Proof of concept (copied exactly from the original report)

**curl to fetch API token**

```
Get the API token by `curl http://localhost:51204/__vitest__/`
```