p PatchFirst

PatchFirst · Latest vulnerabilities

@vitest/browser vulnerabilities

Vulnerabilities published for @vitest/browser in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 5

  1. CVE-2026-112948

    Medium · CVSS 6.5EPSS 0.41%Fix available

    Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

    Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.

    @vitest/browserNode.js
    • Update to 5.0.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-73653

    Critical · CVSS 9.4EPSS 0.79%Fix available

    Vitest: Browser Mode provider commands bypass the file-access permission gate

    Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWrite permission gate or confining paths to the project root. A client that can reach the Browser Mode API can read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process even when allowWrite is false. This issue is fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6.

    @vitest/browser @vitest/browser @vitest/browserNode.js
    • Update to 3.2.7
    • Update to 4.1.10
    • Update to 5.0.0-beta.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-53633

    Critical · CVSS 9.8EPSS 0.9%Fix available

    Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

    Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.

    @vitest/browser @vitest/browser @vitest/browserNode.js
    • Update to 3.2.5
    • Update to 4.1.8
    • Update to 5.0.0-beta.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2026-47428

    Critical · CVSS 9.6EPSS 0.61%Fix available

    Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

    Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.

    @vitest/browser @vitest/browserNode.js
    • Update to 4.1.6
    • Update to 5.0.0-beta.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2025-24963

    Medium · CVSS 5.9EPSS 2.4%Public exploitFix available

    Browser mode serves arbitrary files in vitest

    Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3

    @vitest/browser @vitest/browserNode.js
    • Update to 2.1.9
    • Update to 3.0.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →