@⁠forgerock/interface-mapping-validator-0.0.0.tgz: 2 vulnerabilities (highest severity is: 9.8)

[mend-for-github-com]

Vulnerable Library - @⁠forgerock/interface-mapping-validator-0.0.0.tgz

Path to vulnerable library: /package.json

Found in HEAD commit: 7a45452d171935f45a606e984267233b96a5db0d

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (@⁠forgerock/interface-mapping-validator version)	Remediation Possible**
CVE-2026-47429	Critical	9.8	vitest-3.2.4.tgz	Transitive	N/A*	❌
CVE-2026-41305	Medium	6.1	postcss-8.5.6.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-47429

Vulnerable Library - vitest-3.2.4.tgz

Next generation testing framework powered by Vite

Library home page: https://registry.npmjs.org/vitest/-/vitest-3.2.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• @⁠forgerock/interface-mapping-validator-0.0.0.tgz (Root Library)
  • ❌ vitest-3.2.4.tgz (Vulnerable Library)

Found in HEAD commit: 7a45452d171935f45a606e984267233b96a5db0d

Found in base branch: main

Vulnerability Details

Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network. Impact Only users that match either of the following conditions are affected: - explicitly exposes the Vitest UI server to the network (using "--api.host" or ""api.host" config option" (https://vitest.dev/config/api.html)) - running the Vitest UI or Browser Mode on Windows Details The API handler for "/vitest_attachment" uses the deprecated "isFileServingAllowed" incorrectly. https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/ui/node/index.ts#L77 The function expects the passed value to use "cleanUrl" after the check before file system related operation. Because of this, it is possible to bypass the check by "?..". This is not possible on Linux as Linux errors if a directory named "?" does not exist. A similar problem exists in other places as well. - https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L103-L105 - https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L119-L121 - https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/commands/fs.ts#L10-L11 - https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/plugin.ts#L194-L196 - https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/rpc.ts#L115-L121 That said, this "isFileServingAllowed" check does not actually prevent the API to be abused. Since the API has rerun feature and file write feature, it's possible to run arbitrary script by writing a script as a test file using "saveTestFile" and running it using "rerun". This means exposing the API / Vitest UI is equivalent to giving script execution access. On the browser mode side, there're "readFile" / "writeFile" / "saveSnapshotFile". So exposing the browser mode is equivalent to giving file read / write access. PoC 1. Run Vitest UI 2. Get the API token by "curl http://localhost:51204/vitest/" 3. Run "curl "http://localhost:51204/vitest_attachment?path=C:\path\to\project\?\..\..\secret.txt&contentType=text/plain&token=$TOKEN"" (TOKEN is the API token) 4. curl shows the content of "secret.txt" that is outside the project directory Mitigations Vitest now ships two configuration flags, ""allowWrite"" (https://vitest.dev/config/api.html#api-allowwrite) and ""allowExec"" (https://vitest.dev/config/api.html#api-allowexec), that gate the privileged operations exploited by this vulnerability. Both are disabled by default whenever the API server is bound to a non-"localhost" host, ensuring that exposing the server to the network no longer implicitly grants write or execute capabilities to remote clients. When these flags are disabled, the UI also enters a read-only mode: in-browser code editing and test file execution are turned off, removing the attack surface that allowed remote code execution. Many Browser Mode features are also disabled, like attachments, artifacts or snapshots. See ""browser.api"" (https://vitest.dev/config/browser/api.html#api-allowwrite). Users who require the full interactive UI on a networked host must explicitly opt in by setting "allowWrite" and/or "allowExec" to "true".

Publish Date: 2026-06-01

URL: CVE-2026-47429

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5xrq-8626-4rwp

Release Date: 2026-06-01

Fix Resolution: vitest - 4.1.0

CVE-2026-41305

Vulnerable Library - postcss-8.5.6.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• @⁠forgerock/interface-mapping-validator-0.0.0.tgz (Root Library)
  • vitest-3.2.4.tgz
    • vite-7.3.2.tgz
      • ❌ postcss-8.5.6.tgz (Vulnerable Library)

Found in HEAD commit: 7a45452d171935f45a606e984267233b96a5db0d

Found in base branch: main

Vulnerability Details

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape "</style>" sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML "<style>" tags, "</style>" in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.

Publish Date: 2026-04-24

URL: CVE-2026-41305

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qx2v-qp2m-jg93

Release Date: 2026-04-24

Fix Resolution: postcss - 8.5.10,https://github.com/postcss/postcss.git - 8.5.10