{"schemaVersion":3,"id":"CVE-2026-84373","aliases":["CGA-22f6-p29j-gww5","CGA-3h7q-r78w-f9gp","CGA-5r9f-xvpp-g3r4","CGA-9crp-8mxv-hhfq","CGA-9rr7-67f8-524g","CGA-c9pj-7522-xpf6","CGA-f8pj-r88v-fvhm","CGA-g999-x99f-8wj2","CGA-h734-7jg6-6vv7","CGA-mgcm-vmw7-9hf5","GHSA-82fw-gwwq-j7x9","CGA-2gcf-m8qr-jf2r","CGA-2hwv-5825-p9vm","CGA-2qfp-3v72-gfq3","CGA-3q43-85mr-rpw2","CGA-3x3x-jpw6-45j9","CGA-3xg6-6x83-jj9w","CGA-42v4-9745-3xrf","CGA-45qf-27xf-w867","CGA-4943-hwpm-r49p","CGA-4ggr-xv4w-x352","CGA-4j5q-jfm8-wg88","CGA-4ph9-3hhg-9523","CGA-5289-6r3h-wg4m","CGA-532c-rw4f-2j7r","CGA-54cm-vwm5-8q8f","CGA-5678-6p8h-8q3m","CGA-57gg-52qx-68cj","CGA-58v3-x4m3-h3fj","CGA-59q2-vm72-rgw7","CGA-5mxc-wqx8-8gvg","CGA-5r67-237g-mpm9","CGA-5xj9-8xr2-p7pf","CGA-6424-qmcj-gv2q","CGA-64j5-vhrw-rpm7","CGA-67hh-wvmv-vr9v","CGA-692q-p235-p638","CGA-6ff7-j3p7-jr32","CGA-6mv4-8wh3-8v47","CGA-6vj6-wfxg-pf39","CGA-6x4f-jrvv-7rx5","CGA-72wj-974m-cvw2","CGA-7497-mgfh-rrpp","CGA-76hh-hpp2-589g","CGA-76hm-6542-p5w3","CGA-778q-6g4x-r4wm","CGA-79gv-38r6-224r","CGA-7gp9-pqjh-9j78","CGA-7wwr-qg33-frm8","CGA-86rw-w8hr-gqx6","CGA-8727-4h9r-w86q","CGA-8hjj-p625-2m37","CGA-8j2p-94p5-grmc","CGA-8j3h-f2rj-v3xf","CGA-8r9c-7hq5-6q98","CGA-8rrf-w9c3-f6h8","CGA-8vq8-77p8-246f","CGA-8wh3-9x6v-cxvc","CGA-8x6m-c344-274q","CGA-94g6-56qp-gmmg","CGA-9fhv-566p-w7cp","CGA-9gpx-f99q-w7j4","CGA-9m4g-84jr-2x7v","CGA-c2wj-vv67-8w36","CGA-c5vf-j9h7-hhj5","CGA-c63p-x9r2-v4f4","CGA-c652-89vv-g5wx","CGA-cqhg-77q5-2rj2","CGA-cqr9-r587-36v2","CGA-f45v-9fwc-72hf","CGA-f8gg-w458-q52v","CGA-f8vh-rfqv-m8rj","CGA-fmx8-p3g6-vxw3","CGA-fpmq-v2h3-7x4r","CGA-frgv-fjhv-67r7","CGA-fvc8-crrh-jx9m","CGA-g625-qv3w-2x89","CGA-g6m4-q82h-c88m","CGA-g738-g9w3-hfmh","CGA-ghgr-cq65-7xvp","CGA-gm23-pf73-4w5m","CGA-gqvg-27fq-9vqw","CGA-grpj-crhp-mfp4","CGA-gwhh-fqwm-rfrg","CGA-gwwv-vm84-xwj5","CGA-h7cq-fp32-mgq5","CGA-h87q-j39v-5c65","CGA-h935-v8qg-wg6j","CGA-hc3c-x669-mhjg","CGA-hcj5-xwrj-9j98","CGA-hgjp-jwjm-jxh4","CGA-hw4v-v93w-3f7h","CGA-hw87-m5p6-rv56","CGA-hwx2-29vp-7jjc","CGA-j294-8q5x-v5vr","CGA-j42v-p89m-hw67","CGA-jhpf-7w2c-mg4c","CGA-jpqm-xmmc-r8gc","CGA-m49g-xx6m-77j7","CGA-m8g4-3rww-4vhg","CGA-mf4v-mfq8-wh5x","CGA-mv75-gp3r-xqg9","CGA-mvg2-9h25-5c2p","CGA-mx4c-qprw-q4c3","CGA-p2q4-5cq3-2543","CGA-p3cm-6836-c8wv","CGA-p445-xc5r-qcpj","CGA-p4xj-gr75-32g8","CGA-p93j-x9pv-3mrw","CGA-pg46-99q6-gr78","CGA-pg55-2vhr-cj39","CGA-ph66-q56r-g9pj","CGA-pj98-q5vw-6ffq","CGA-pq6c-hhrr-c97h","CGA-pqgp-vfww-c2h4","CGA-pv7w-cmp7-r7q4","CGA-pw38-4pjw-h8j5","CGA-pw62-759w-f8jm","CGA-pxfp-vpr3-mh8r","CGA-q82h-w89h-qq64","CGA-q8gh-rgpq-g9hr","CGA-q9mq-hxc6-5xx7","CGA-qv84-936f-gqq4","CGA-rcq4-c6v5-pf46","CGA-rh4r-r9hh-fr52","CGA-rqm3-h8q7-64m5","CGA-rr5h-qvxc-h47m","CGA-rvp2-94v7-8f4w","CGA-rwg3-24fr-rhjf","CGA-v3xx-97v7-5g74","CGA-v4hm-xfmc-qrgm","CGA-v72w-98hf-4fx5","CGA-vpcw-gww6-4cc2","CGA-vpjq-x6fp-p9mg","CGA-w3vm-j3w6-pv7g","CGA-w5jr-f7mm-x7vv","CGA-w5rx-m93x-fhr5","CGA-w7qx-8hgf-jhfr","CGA-wgc6-5724-f2jx","CGA-wppv-vhwv-6c9v","CGA-wvvv-7rhj-5r24","CGA-x54q-v9w4-f88g","CGA-x64x-w6xj-j2j9","CGA-x675-f3hx-5vhv","CGA-x6p6-vxfw-4hjq","CGA-x746-28x4-96rw","CGA-xmpg-phc5-52j7","CGA-xqgc-cf2q-w253","CGA-xv7x-qq7f-9j9m"],"status":"published","duplicateOf":null,"title":null,"description":"Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.","dates":{"published":"2026-09-01T21:26:26.110Z","modified":"2026-09-02T13:22:16.806Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.9,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00527,"percentile":0.43525,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.15200000000000005,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00375},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00527,"percentile":0.43525}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00527,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00527,"percentile":0.43525}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.1","name":"commercial-gitlab-rails-ee-19.1","label":"commercial-gitlab-rails-ee-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.2","name":"commercial-gitlab-rails-ee-19.2","label":"commercial-gitlab-rails-ee-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.3","name":"commercial-gitlab-rails-ee-19.3","label":"commercial-gitlab-rails-ee-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.4","name":"commercial-gitlab-rails-ee-19.4","label":"commercial-gitlab-rails-ee-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.1","name":"commercial-gitlab-rails-ee-fips-19.1","label":"commercial-gitlab-rails-ee-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.2","name":"commercial-gitlab-rails-ee-fips-19.2","label":"commercial-gitlab-rails-ee-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.3","name":"commercial-gitlab-rails-ee-fips-19.3","label":"commercial-gitlab-rails-ee-fips-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.4","name":"commercial-gitlab-rails-ee-fips-19.4","label":"commercial-gitlab-rails-ee-fips-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.10","name":"gitlab-rails-ce-18.10","label":"gitlab-rails-ce-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.7","name":"gitlab-rails-ce-18.7","label":"gitlab-rails-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.0","name":"gitlab-rails-ce-19.0","label":"gitlab-rails-ce-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.1","name":"gitlab-rails-ce-19.1","label":"gitlab-rails-ce-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.1","purlType":"apk","versions":[{"text":"< 19.1.8-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.8-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.2","name":"gitlab-rails-ce-19.2","label":"gitlab-rails-ce-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.2","purlType":"apk","versions":[{"text":"< 19.2.6-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.6-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.3","name":"gitlab-rails-ce-19.3","label":"gitlab-rails-ce-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.3","purlType":"apk","versions":[{"text":"< 19.3.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.2-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"< 18.10.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.10.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.7","name":"gitlab-rails-ce-fips-18.7","label":"gitlab-rails-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"< 19.0.9-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.9-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.1","name":"gitlab-rails-ce-fips-19.1","label":"gitlab-rails-ce-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.1","purlType":"apk","versions":[{"text":"< 19.1.8-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.8-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.2","name":"gitlab-rails-ce-fips-19.2","label":"gitlab-rails-ce-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.5-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.5-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.3","name":"gitlab-rails-ce-fips-19.3","label":"gitlab-rails-ce-fips-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.3","purlType":"apk","versions":[{"text":"< 19.3.1-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.1-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"homepage","name":"homepage","label":"homepage","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/homepage","purlType":"apk","versions":[{"text":"< 2.3.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.3.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-compat","name":"langfuse-3-compat","label":"langfuse-3-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-compat","purlType":"apk","versions":[{"text":"< 3.225.7-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.7-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.225.7-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.7-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-4-worker","name":"langfuse-4-worker","label":"langfuse-4-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-4-worker","purlType":"apk","versions":[{"text":"< 4.32.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.32.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3-worker","name":"langfuse-fips-3-worker","label":"langfuse-fips-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3-worker","purlType":"apk","versions":[{"text":"< 3.225.7-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.7-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-4-worker","name":"langfuse-fips-4-worker","label":"langfuse-fips-4-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-4-worker","purlType":"apk","versions":[{"text":"< 4.33.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.33.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-22","name":"vitess-22","label":"vitess-22","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-22","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-24","name":"vitess-24","label":"vitess-24","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-24","purlType":"apk","versions":[{"text":"< 24.0.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.3-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-24-compat","name":"vitess-24-compat","label":"vitess-24-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-24-compat","purlType":"apk","versions":[{"text":"< 24.0.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.3-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-compat","name":"langfuse-3-compat","label":"langfuse-3-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-compat","purlType":"apk","versions":[{"text":"< 3.225.7-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.7-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.225.7-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.7-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-24","name":"vitess-24","label":"vitess-24","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-24","purlType":"apk","versions":[{"text":"< 24.0.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.3-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-24-compat","name":"vitess-24-compat","label":"vitess-24-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-24-compat","purlType":"apk","versions":[{"text":"< 24.0.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.3-r7","eol":null,"hubHref":null},{"vendor":"Npm","product":"vitest","name":"vitest","label":"vitest","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/vitest","purlType":"npm","versions":[{"text":"≥ 2.1.0, < 4.1.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0-beta.1, < 5.0.0-rc.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.1.0, < 4.1.11 | ≥ 5.0.0-beta.1, < 5.0.0-rc.2","eol":null,"hubHref":null},{"vendor":"@vitest","product":"mocker","name":"@vitest/mocker","label":"mocker","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@vitest/mocker","purlType":"npm","versions":[{"text":"≥ 2.1.0, < 4.1.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0-beta.1, < 5.0.0-rc.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.1.0, < 4.1.11 | ≥ 5.0.0-beta.1, < 5.0.0-rc.2","eol":null,"hubHref":null},{"vendor":"vitest-dev","product":"vitest","name":"vitest","label":"vitest","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.1.0, < 4.1.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0-beta.1, < 5.0.0-rc.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.1.0, < 4.1.11 | ≥ 5.0.0-beta.1, < 5.0.0-rc.2","eol":null,"hubHref":"/vendor/vitest-dev/vitest"},{"vendor":"@vitest","product":"mocker","name":"mocker","label":"mocker","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.1.0, < 4.1.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0-beta.1, < 5.0.0-rc.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.1.0, < 4.1.11 | ≥ 5.0.0-beta.1, < 5.0.0-rc.2","eol":null,"hubHref":"/vendor/vitest/mocker"}],"affectedCount":41,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9","label":"github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB"]},{"url":"https://github.com/vitest-dev/vitest/pull/10972","label":"github.com/vitest-dev/vitest/pull/10972","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/vitest-dev/vitest/pull/10974","label":"github.com/vitest-dev/vitest/pull/10974","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8","label":"github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4","label":"github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f","label":"github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/vitest-dev/vitest/releases/tag/v4.1.11","label":"github.com/vitest-dev/vitest/releases/tag/v4.1.11","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2","label":"github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84373.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84373.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84373","label":"nvd.nist.gov/vuln/detail/CVE-2026-84373","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/vitest-dev/vitest","label":"github.com/vitest-dev/vitest","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-01T21:26:26.110Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-02T13:22:16.806Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":24,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T13:38:51.118Z","stale":false,"partial":false}}