[GHSA-5xrq-8626-4rwp] When Vitest UI server is listening, arbitrary file can be read and executed

[koteswar-k]

Updates

• Affected products

Comments
Hi Advisory DB team, for GHSA-5xrq-8626-4rwp we see a range mismatch between Advisory DB and the maintainer advisory.
Maintainer advisory indicates patched versions include 3.2.5 and 4.1.0, but npm audit still flags vitest@3.2.6 as vulnerable in our environment.
Could you verify whether the normalized advisory range in Advisory DB (and downstream audit feeds) is up to date for the 3.x patched line?

GHSA-5xrq-8626-4rwp

[github]

Hi there @hi-ogawa! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory