CVE-2026-73653criticalCWE-22CWE-552CWE-862

CVE-2026-73653: critical vulnerability in vitest-dev vitest

Vitest: Browser Mode provider commands bypass the file-access permission gate

Published

Follow this CVE+ Monitor vitest+ Monitor @vitest/browser

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.4epss 0.8%
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWrite permission gate or confining paths to the project root. A client that can reach the Browser Mode API can read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process even when allowWrite is false. This issue is fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected products
vitest-dev · vitest
Related CVEs — vitest-dev vitest

In the same product, most dangerous first.

CVE-2025-24963MEDIUMBrowser mode serves arbitrary files in vitestEPSS 2.4%CVE-2026-47429CRITICALVitest: Arbitrary file can be read and executed when Vitest UI server is listeningEPSS 1.0%CVE-2026-53633CRITICALVitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCEEPSS 0.9%CVE-2025-24964CRITICALRemote Code Execution when accessing a malicious website while Vitest API server is listeningEPSS 0.7%CVE-2026-47428CRITICALVitest browser mode serves unsanitized otelCarrier query parameter as inline scriptEPSS 0.6%CVE-2026-112950MEDIUMVitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fixEPSS 0.5%