CVE-2026-47429 CrowdStrike LogScale · LogScale

Detect CVE-2026-47429: Vitest UI Server Arbitrary File Read and Execution in CrowdStrike LogScale

CVE-2026-47429 is a critical missing authorization vulnerability (CWE-862, CVSS 9.8) in the Vitest UI server. When the Vitest UI server is listening, unauthenticated remote attackers can read arbitrary files from the filesystem and execute arbitrary code. Affected versions include Vitest < 3.2.6 and >= 4.0.0, < 4.1.0. A public proof-of-concept exists. Exploitation typically involves sending crafted WebSocket or HTTP requests to the Vitest UI server's RPC endpoint to traverse the filesystem or trigger code execution via the browser plugin's file system command handlers.

MITRE ATT&CK

Tactic
Initial Access Credential Access Execution

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName IN (ProcessRollup2, NetworkConnectIP4, NetworkConnectIP6, FileOpenInfo)
| ImageFileName = /node(\.exe)?$/i
| CommandLine = /vitest/i AND CommandLine = /(--ui|vitest ui)/i
| groupBy([aid, ComputerName, UserName], function=[
    collect(CommandLine, limit=10),
    collect(RemoteIP, limit=10),
    collect(RemotePort, limit=10),
    collect(TargetFileName, limit=20),
    count()
  ])
| RemotePort IN (51204, 51205, 5173, 5174, 4173)
| NOT RemoteIP IN ("127.0.0.1", "::1", "0:0:0:0:0:0:0:1")
| TargetFileName = /(\.env$|id_rsa|id_ed25519|\.pem|shadow|passwd|credentials|secrets|\.aws\/credentials)/i
| eval RiskLevel = if(TargetFileName matches /(\.env|id_rsa|id_ed25519|\.pem|aws)/, "CRITICAL", "HIGH")
| sort(-RiskLevel, -count)
| rename ComputerName AS hostname, UserName AS affected_user
critical severity high confidence

CrowdStrike Falcon CQL query detecting Vitest UI processes with external network connections to Vitest default ports combined with sensitive file access, targeting CVE-2026-47429 exploitation across the fleet.

Data Sources

CrowdStrike Falcon EDRCrowdStrike Process EventsCrowdStrike Network Events

Required Tables

ProcessRollup2NetworkConnectIP4FileOpenInfo

False Positives & Tuning

  • Developer endpoints where vitest --ui is part of standard frontend development workflow
  • Pentest or red team systems running authorized Vitest exploit simulations
  • Build servers in private subnets that expose Vitest UI within trusted network segments
  • Security tooling that monitors Vitest endpoints and itself generates file access events

Other platforms for CVE-2026-47429

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2026-47429 - Vitest UI Arbitrary File Read via RPC

    Expected signal: Network connection from external IP to port 5173; node process file open event for /etc/passwd; WebSocket upgrade request in proxy logs

  2. Test 2CVE-2026-47429 - Vitest UI Credential File Exfiltration Simulation

    Expected signal: Sequence of file open events for multiple sensitive paths initiated by node process; multiple WebSocket messages to Vitest UI port within short timeframe

  3. Test 3CVE-2026-47429 - Vitest UI Remote Code Execution via Test Execution

    Expected signal: Child process spawned by node with shell command arguments; file creation event at /tmp/vitest-rce-proof.txt; Sysmon Event ID 1 for child process of node.exe/node

Last updated: 2026-06-21 Research depth: standard
References (8)

Unlock Pro Content

Get the full detection package for CVE-2026-47429 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0001Initial AccessTA0006Credential AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1083File and Directory DiscoveryT1059.007JavaScriptT1552.001Credentials In Files

Same Tactic: Initial Access

Popular Detections