CVE-2026-73653criticalCWE-22CWE-552CWE-862

CVE-2026-73653: falha crítica em vitest-dev vitest

Vitest: Browser Mode provider commands bypass the file-access permission gate

Publicada em

Seguir esta CVE+ Monitorar vitest+ Monitorar @vitest/browser

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.4epss 0.8%
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWrite permission gate or confining paths to the project root. A client that can reach the Browser Mode API can read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process even when allowWrite is false. This issue is fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Produtos afetados
vitest-dev · vitest
CVEs relacionadas — vitest-dev vitest

No mesmo produto, das mais perigosas para as menos.

CVE-2025-24963MEDIUMBrowser mode serves arbitrary files in vitestEPSS 2.4%CVE-2026-47429CRITICALVitest: Arbitrary file can be read and executed when Vitest UI server is listeningEPSS 1.0%CVE-2026-53633CRITICALVitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCEEPSS 0.9%CVE-2025-24964CRITICALRemote Code Execution when accessing a malicious website while Vitest API server is listeningEPSS 0.7%CVE-2026-47428CRITICALVitest browser mode serves unsanitized otelCarrier query parameter as inline scriptEPSS 0.6%CVE-2026-112950MEDIUMVitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fixEPSS 0.5%