Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.6%
probabilidade de exploração
0.6%top 56% das CVEs
exploração observada
nãonenhuma fonte reporta
Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
vitest-dev · vitestReferências
https://github.com/vitest-dev/vitest/commit/385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7https://github.com/vitest-dev/vitest/commit/63e3b2eee4d58da56786a6333f517b9b492528c7https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9https://github.com/vitest-dev/vitest/pull/10444https://github.com/vitest-dev/vitest/pull/10450https://github.com/vitest-dev/vitest/pull/10456https://github.com/vitest-dev/vitest/releases/tag/v3.2.5https://github.com/vitest-dev/vitest/releases/tag/v4.1.8https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.4https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm