p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de @vitest/browser

Vulnérabilités publiées pour @vitest/browser au cours des 30 derniers jours : 1. Présentes dans le catalogue KEV : 0.

RSS ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 5

  1. CVE-2026-112948

    Moyenne · CVSS 6.5EPSS 0,41%Correctif disponible

    Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

    Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.

    @vitest/browserNode.js
    • Mettez à jour vers 5.0.5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-73653

    Critique · CVSS 9.4EPSS 0,79%Correctif disponible

    Vitest: Browser Mode provider commands bypass the file-access permission gate

    Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWrite permission gate or confining paths to the project root. A client that can reach the Browser Mode API can read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process even when allowWrite is false. This issue is fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6.

    @vitest/browser @vitest/browser @vitest/browserNode.js
    • Mettez à jour vers 3.2.7
    • Mettez à jour vers 4.1.10
    • Mettez à jour vers 5.0.0-beta.6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2026-53633

    Critique · CVSS 9.8EPSS 0,9%Correctif disponible

    Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

    Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.

    @vitest/browser @vitest/browser @vitest/browserNode.js
    • Mettez à jour vers 3.2.5
    • Mettez à jour vers 4.1.8
    • Mettez à jour vers 5.0.0-beta.4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2026-47428

    Critique · CVSS 9.6EPSS 0,61%Correctif disponible

    Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

    Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.

    @vitest/browser @vitest/browserNode.js
    • Mettez à jour vers 4.1.6
    • Mettez à jour vers 5.0.0-beta.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2025-24963

    Moyenne · CVSS 5.9EPSS 2,4%Code d’exploitation publicCorrectif disponible

    Browser mode serves arbitrary files in vitest

    Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3

    @vitest/browser @vitest/browserNode.js
    • Mettez à jour vers 2.1.9
    • Mettez à jour vers 3.0.4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →