CVE-2026-73653 vitest-dev CVE debrief

Who should care

Developers and administrators using Vitest for testing, especially those with exposure to the Browser Mode API, should assess their exposure and upgrade to a fixed version to prevent potential attacks. They should also review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, they should monitor for suspicious activity and track exceptions, retest remediated assets, and close the item only after evidence is

Why it matters

CVE-2026-73653 is a critical vulnerability in Vitest that allows an attacker to access and modify files on the system. Developers and administrators using Vitest should assess their exposure and upgrade to a fixed version to prevent potential attacks.

• Read arbitrary local files accessible to the Vitest process
• Create or overwrite image and trace files
• Delete files accessible to the Vitest process

Technical summary

The vulnerability in Vitest allows an attacker to read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process due to improper handling of browser-supplied file paths in Browser Mode provider commands. This can lead to unauthorized access and modification of files on the system. The fixed versions are 3.2.7, 4.1.10, and 5.0.0-beta.6. No additional technical details are available. The issue requires immediate attention to prevent potential attacks. Developers and administrators using Vitest for testing should assess their exposure and upgrade to a fixed version.

Defensive priority

High

Recommended defensive actions

• Upgrade to Vitest version 3.2.7, 4.1.10, or 5.0.0-beta.6 or later
• Restrict access to the Browser Mode API
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its impact, and the fixed versions. The vulnerability is caused by the lack of proper validation of browser-supplied file paths in Browser Mode provider commands, which allows an attacker to access and modify files on the system. The fixed versions are 3.2.7, 4.1.10, and 5.0.0-beta.6. No additional evidence is available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.