{"items":[{"id":"NVI-00010737","kind":"vulnerability","title":"Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-p458-7748-mcp3","CVE-2026-112948"],"plain_summary":"GitHub lists this reviewed advisory for @vitest/ui, @vitest/browser, vite-plus. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-235cc0ec69b6fba5efbd18c9b380b793"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 5.0.5 for @vitest/ui. Confirm the publisher’s latest guidance.","source_ids":["sr-c0463365e2517f80315feac82e6f398e"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 5.0.5 for @vitest/browser. Confirm the publisher’s latest guidance.","source_ids":["sr-c0463365e2517f80315feac82e6f398e"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.3.0 for vite-plus. Confirm the publisher’s latest guidance.","source_ids":["sr-c0463365e2517f80315feac82e6f398e"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-21T19:57:01.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-d83d41047c9a912f8c1d5031c798005c"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.400%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.34308. Missing scores are unknown.","source_id":"sr-235cc0ec69b6fba5efbd18c9b380b793"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-d83d41047c9a912f8c1d5031c798005c","url":"https://github.com/advisories/GHSA-p458-7748-mcp3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-p458-7748-mcp3","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:30.906Z"},{"id":"sr-c0463365e2517f80315feac82e6f398e","url":"https://github.com/advisories/GHSA-p458-7748-mcp3","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-p458-7748-mcp3","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-06T20:56:44.859Z"},{"id":"sr-235cc0ec69b6fba5efbd18c9b380b793","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-112948","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.265Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-d83d41047c9a912f8c1d5031c798005c"],"technology":"@vitest/ui","known_exclusions":[],"conditions_summary":"### Summary\n\nIn Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.\n\nThis only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.\n\n### Details\n\nVitest 5 adds its API token file to `server.fs.deny`, but neither server ended up with the intended list. That's because of two Vite behaviors. ","public_affected_ranges":[">= 5.0.0-beta.6, < 5.0.5"]},{"certainty":"source_listed","source_ids":["sr-d83d41047c9a912f8c1d5031c798005c"],"technology":"@vitest/browser","known_exclusions":[],"conditions_summary":"### Summary\n\nIn Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.\n\nThis only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.\n\n### Details\n\nVitest 5 adds its API token file to `server.fs.deny`, but neither server ended up with the intended list. That's because of two Vite behaviors. ","public_affected_ranges":[">= 5.0.0-beta.6, < 5.0.5"]},{"certainty":"source_listed","source_ids":["sr-d83d41047c9a912f8c1d5031c798005c"],"technology":"vite-plus","known_exclusions":[],"conditions_summary":"### Summary\n\nIn Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.\n\nThis only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.\n\n### Details\n\nVitest 5 adds its API token file to `server.fs.deny`, but neither server ended up with the intended list. That's because of two Vite behaviors. ","public_affected_ranges":[">= 1.0.0-rc.0, < 1.3.0"]},{"certainty":"source_listed","source_ids":["sr-c0463365e2517f80315feac82e6f398e"],"technology":"@vitest/ui","known_exclusions":[],"conditions_summary":"### Summary\n\nIn Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.\n\nThis only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.\n\n### Details\n\nVitest 5 adds its API token file to `server.fs.deny`, but neither server ended up with the intended list. That's because of two Vite behaviors. ","public_affected_ranges":["SEMVER: introduced 5.0.0-beta.6; fixed 5.0.5"]},{"certainty":"source_listed","source_ids":["sr-c0463365e2517f80315feac82e6f398e"],"technology":"@vitest/browser","known_exclusions":[],"conditions_summary":"### Summary\n\nIn Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.\n\nThis only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.\n\n### Details\n\nVitest 5 adds its API token file to `server.fs.deny`, but neither server ended up with the intended list. That's because of two Vite behaviors. ","public_affected_ranges":["SEMVER: introduced 5.0.0-beta.6; fixed 5.0.5"]},{"certainty":"source_listed","source_ids":["sr-c0463365e2517f80315feac82e6f398e"],"technology":"vite-plus","known_exclusions":[],"conditions_summary":"### Summary\n\nIn Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.\n\nThis only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.\n\n### Details\n\nVitest 5 adds its API token file to `server.fs.deny`, but neither server ended up with the intended list. That's because of two Vite behaviors. ","public_affected_ranges":["SEMVER: introduced 1.0.0-rc.0; fixed 1.3.0"]}],"null_published_at":"2026-11-07T00:57:04.327Z","source_updated_at":"2026-10-21T19:57:01.000Z","source_disclosed_at":"2026-10-21T19:57:00.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T22:07:30.906Z"},{"id":"NVI-00010737","kind":"vulnerability","title":"Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-p458-7748-mcp3","CVE-2026-112948"],"plain_summary":"GitHub lists this reviewed advisory for @vitest/ui, @vitest/browser, vite-plus. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-235cc0ec69b6fba5efbd18c9b380b793"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-21T19:57:01.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-d83d41047c9a912f8c1d5031c798005c"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.400%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.34308. Missing scores are unknown.","source_id":"sr-235cc0ec69b6fba5efbd18c9b380b793"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-d83d41047c9a912f8c1d5031c798005c","url":"https://github.com/advisories/GHSA-p458-7748-mcp3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-p458-7748-mcp3","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:30.906Z"},{"id":"sr-235cc0ec69b6fba5efbd18c9b380b793","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-112948","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.265Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-d83d41047c9a912f8c1d5031c798005c"],"technology":"@vitest/ui","known_exclusions":[],"conditions_summary":"### Summary\n\nIn Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.\n\nThis only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.\n\n### Details\n\nVitest 5 adds its API token file to `server.fs.deny`, but neither server ended up with the intended list. That's because of two Vite behaviors. ","public_affected_ranges":[">= 5.0.0-beta.6, < 5.0.5"]},{"certainty":"source_listed","source_ids":["sr-d83d41047c9a912f8c1d5031c798005c"],"technology":"@vitest/browser","known_exclusions":[],"conditions_summary":"### Summary\n\nIn Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.\n\nThis only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.\n\n### Details\n\nVitest 5 adds its API token file to `server.fs.deny`, but neither server ended up with the intended list. That's because of two Vite behaviors. ","public_affected_ranges":[">= 5.0.0-beta.6, < 5.0.5"]},{"certainty":"source_listed","source_ids":["sr-d83d41047c9a912f8c1d5031c798005c"],"technology":"vite-plus","known_exclusions":[],"conditions_summary":"### Summary\n\nIn Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.\n\nThis only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.\n\n### Details\n\nVitest 5 adds its API token file to `server.fs.deny`, but neither server ended up with the intended list. That's because of two Vite behaviors. ","public_affected_ranges":[">= 1.0.0-rc.0, < 1.3.0"]}],"null_published_at":"2026-11-04T18:04:03.180Z","source_updated_at":"2026-10-21T19:57:01.000Z","source_disclosed_at":"2026-10-21T19:57:00.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T22:07:30.906Z"},{"id":"NVI-00010737","kind":"vulnerability","title":"Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-p458-7748-mcp3","CVE-2026-112948"],"plain_summary":"GitHub lists this reviewed advisory for @vitest/ui, @vitest/browser, vite-plus. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-d83d41047c9a912f8c1d5031c798005c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-21T19:57:01.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-d83d41047c9a912f8c1d5031c798005c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-d83d41047c9a912f8c1d5031c798005c","url":"https://github.com/advisories/GHSA-p458-7748-mcp3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-p458-7748-mcp3","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:30.906Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-d83d41047c9a912f8c1d5031c798005c"],"technology":"@vitest/ui","known_exclusions":[],"conditions_summary":"### Summary\n\nIn Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.\n\nThis only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.\n\n### Details\n\nVitest 5 adds its API token file to `server.fs.deny`, but neither server ended up with the intended list. That's because of two Vite behaviors. ","public_affected_ranges":[">= 5.0.0-beta.6, < 5.0.5"]},{"certainty":"source_listed","source_ids":["sr-d83d41047c9a912f8c1d5031c798005c"],"technology":"@vitest/browser","known_exclusions":[],"conditions_summary":"### Summary\n\nIn Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.\n\nThis only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.\n\n### Details\n\nVitest 5 adds its API token file to `server.fs.deny`, but neither server ended up with the intended list. That's because of two Vite behaviors. ","public_affected_ranges":[">= 5.0.0-beta.6, < 5.0.5"]},{"certainty":"source_listed","source_ids":["sr-d83d41047c9a912f8c1d5031c798005c"],"technology":"vite-plus","known_exclusions":[],"conditions_summary":"### Summary\n\nIn Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.\n\nThis only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.\n\n### Details\n\nVitest 5 adds its API token file to `server.fs.deny`, but neither server ended up with the intended list. That's because of two Vite behaviors. ","public_affected_ranges":[">= 1.0.0-rc.0, < 1.3.0"]}],"null_published_at":"2026-10-31T22:27:12.379Z","source_updated_at":"2026-10-21T19:57:01.000Z","source_disclosed_at":"2026-10-21T19:57:00.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:07:30.906Z"}],"next_cursor":null,"snapshot_revision":"42594"}