On October 21, 2026, the GitHub Advisory Database published CVE-2026-112948 (GHSA-p458-7748-mcp3), exposing a critical file access misconfiguration in Vitest 5 dev servers.

Under specific developer configurations—specifically when running the interactive UI ( vitest --ui ), Browser Mode ( @vitest/browser ), or when enabling the remote api flag—Vitest's underlying HTTP server failed to apply Vite's default server.fs.deny rules.

The outcome: sensitive project assets that Vite ordinarily guards by default—including .env , .env.local , .npmrc , private SSL certificates, .git metadata, and Vitest's internal authentication token file ( .vitest-secret-token )—could be fetched over plain HTTP by any client reachable on the network or by a malicious browser tab via cross-origin requests.

Here is an engineering audit of what went wrong, how to check if your workstation was exposed, and how to safely rotate compromised tokens.

The Vulnerability Breakdown: Why server.fs.deny Was Overridden

In a standard Vite…