A critical vulnerability in Vitest, a testing framework powered by Vite, allows an attacker to read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process. This issue is fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6. The vulnerability exists due to improper handling of browser-supplied file paths in Browser Mode provider commands, which can l [truncated]
CVE-2026-53633 is a critical vulnerability in Vitest Browser Mode, allowing remote code execution via the Chrome DevTools Protocol. Versions 3.0.0 to 3.2.5, 4.1.8, and 5.0.0-beta.4 are affected. The issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta. The vulnerability has a CVSS score of 9.8 and is classified as CRITICAL. The vulnerability exists in the Vitest Browser Mode's cdp() API, which exposes [truncated]
CVE-2026-47429 is a critical vulnerability in Vitest, a testing framework powered by Vite. Prior to versions 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing path traversal to read files outside the project. Exposed API features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in v [truncated]
