Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
@vitest/mocker registers a redirect mock's target path without validating it against the dev server's file-serving allowlist. An attacker who can reach the dev server's WebSocket can register a redirect mock pointing outside the project root; when the mocked module is requested, the plugin's load hook returns readFile(<attacker path>) as the module source, disclosing local files. This is exploitable without authentication only through the public mockerPlugin / standalone interceptorPlugin exports (used …