Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

Affected: npm: vitest

### Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network.

### Impact Only users that match either of the following conditions are affected:

- explicitly exposes the Vitest UI server to the network (using `--api.host` or [`api.host` config option](https://vitest.dev/config/api.html)) - running the Vitest UI or Browser Mode on Windows

### Details The API handler…

vitest: Vitest: Arbitrary code execution via crafted browser-runner URL vitest: Vitest: Arbitrary code execution and information disclosure via path traversal