CVE-2026-53633 is a critical vulnerability in Vitest Browser Mode, allowing remote code execution via the Chrome DevTools Protocol. Versions 3.0.0 to 3.2.5, 4.1.8, and 5.0.0-beta.4 are affected. The issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta. The vulnerability has a CVSS score of 9.8 and is classified as CRITICAL. The vulnerability exists in the Vitest Browser Mode's cdp() API, which exposes [truncated]
CVE-2026-47429 is a critical vulnerability in Vitest, a testing framework powered by Vite. Prior to versions 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing path traversal to read files outside the project. Exposed API features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in v [truncated]
