CVE-2026-53633
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A vulnerability in Vitest Browser Mode allows a remote attacker to bypass access controls and execute arbitrary Node.js code. The cdp() API forwards Chrome DevTools Protocol methods without checking allowWrite or allowExec permissions, enabling manipulation of the vite.config.ts file.
Risk Assessment
An attacker can take over the development server by overwriting Vite configuration and executing malicious code, leading to full compromise of the testing environment and potentially production systems.
Recommendation
Upgrade Vitest to version 3.2.5, 4.1.8, or 5.0.0-beta (or later) immediately. If upgrading is not possible, disable Browser Mode or restrict access to the cdp() API.
Original NVD description (English source)
Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.