@vitest browser vulnerabilities

Latest @vitest browser CVEs

Newest publication first

1. CVE-2026-112948 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

   Published 2026-10-20

   Medium·CVSS 6.5 EPSS 0.40%

   Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an...

2. CVE-2026-73653 Vitest: Browser Mode provider commands bypass the file-access permission gate

   Published 2026-08-13

   Critical·CVSS 9.4 EPSS 0.79%

   Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enfor...

3. CVE-2026-53633 Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

   Published 2026-07-14

   Critical·CVSS 9.8 EPSS 0.90%

   Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browse...

4. CVE-2026-47428 Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

   Published 2026-07-14

   Critical·CVSS 9.6 EPSS 0.58%

   Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /vitest_test/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaSc...

5. CVE-2025-24963 Browser mode serves arbitrary files in vitest

   Published 2025-02-04

   High·CVSS 7.5 EPSS 2.4%

   Vitest is a testing framework powered by Vite. The __screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler fr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.