Go to packages list

vitest-browser

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)
  • 3CriticalAffects 8 versions
  • 0HighAffects 0 versions
  • 0MediumAffects 0 versions
  • 2ModerateAffects 3 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
5vulnerabilities
  • Critical3 (60.0%)
  • High0 (0.0%)
  • Medium0 (0.0%)
  • Moderate2 (40.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 1
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 2 vulnerabilities
    • Critical: 2
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0

Vulnerabilities (5)

Known vulnerabilities affecting vitest-browser, based on data from OSV.

Vulnerabilities affecting vitest-browser
IDSeveritySummaryAffected versionsPublishedSource
GHSA-p458-7748-mcp3ModerateVitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file### Summary In Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser. This only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enable
  • >= 5.0.0-beta.6, < 5.0.5
GitHub (opens in a new tab)
GHSA-p63j-vcc4-9vmvCritical@vitest/browser: Browser Mode provider commands bypass the file-access permission gate## Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem (taking screenshots, managing Playwright traces, uploading files for `<input type="file">`, comparing screenshots). Several of these commands accept a file path from the browser and act on it without checking the `allowWrite` permission gate and without confining the path to the project directory. A client that can reach the Browser Mode API can therefore read, create, overwrite, or delete files anywhere the Vitest process can access, even when `allo
  • >= 4.0.0, < 4.1.10
  • < 3.2.7
  • >= 5.0.0-beta.1, < 5.0.0-beta.6
GitHub (opens in a new tab)
GHSA-g8mr-85jm-7xhmCriticalVitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE## Summary Vitest Browser Mode exposes a `cdp()` API that forwards raw Chrome DevTools Protocol (CDP) methods over the Vitest browser WebSocket RPC. CDP is not gated by `browser.api.allowWrite`, `browser.api.allowExec`, `api.allowWrite`, or `api.allowExec`. As a result, disabling Browser Mode write and exec operations does not prevent a browser API client from using CDP to perform equivalent actions. In a verified reproduction with `allowWrite: false` and `allowExec: false`, CDP `Page.setDownloadBehavior` set the browser download directory to the project root, and CDP `Runtime.evaluate` down
  • >= 5.0.0-beta.0, < 5.0.0-beta.4
  • >= 4.0.0, < 4.1.8
  • >= 3.0.0, < 3.2.5
GitHub (opens in a new tab)
GHSA-2h32-95rg-cpppCriticalVitest browser mode serves unsanitized otelCarrier query parameter as inline script## Summary Vitest browser mode served `/__vitest_test__/` with the `otelCarrier` query parameter inserted directly into an inline module script. Because this value was treated as JavaScript source rather than data, an attacker could craft a browser-runner URL that executes arbitrary JavaScript in the Vitest server origin. https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/node/serverOrchestrator.ts#L48 https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/client/public/esm-client-injector.
  • >= 4.0.17, < 4.1.6
  • >= 5.0.0-beta.0, < 5.0.0-beta.3
GitHub (opens in a new tab)
GHSA-8gvc-j273-4wm5ModerateVitest browser mode serves arbitrary files### Summary `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by [`browser.api.host: true`](https://vitest.dev/guide/browser/config.html#browser-api), an attacker can send a request to that handler from remote to get the content of arbitrary files. ### Details This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130
  • >= 2.0.4, < 2.1.9
  • >= 3.0.0, < 3.0.4
GitHub (opens in a new tab)
  • GHSA-p458-7748-mcp3Moderate
    Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
    • >= 5.0.0-beta.6, < 5.0.5
    GitHub (opens in a new tab)

    ### Summary In Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser. This only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enable

    CVE: CVE-2026-112948

  • GHSA-p63j-vcc4-9vmvCritical
    @vitest/browser: Browser Mode provider commands bypass the file-access permission gate
    • >= 4.0.0, < 4.1.10
    • < 3.2.7
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 4.0.0, < 4.1.10
    • < 3.2.7
    • >= 5.0.0-beta.1, < 5.0.0-beta.6

    ## Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem (taking screenshots, managing Playwright traces, uploading files for `<input type="file">`, comparing screenshots). Several of these commands accept a file path from the browser and act on it without checking the `allowWrite` permission gate and without confining the path to the project directory. A client that can reach the Browser Mode API can therefore read, create, overwrite, or delete files anywhere the Vitest process can access, even when `allo

    CVE: CVE-2026-73653

  • GHSA-g8mr-85jm-7xhmCritical
    Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
    • >= 5.0.0-beta.0, < 5.0.0-beta.4
    • >= 4.0.0, < 4.1.8
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 5.0.0-beta.0, < 5.0.0-beta.4
    • >= 4.0.0, < 4.1.8
    • >= 3.0.0, < 3.2.5

    ## Summary Vitest Browser Mode exposes a `cdp()` API that forwards raw Chrome DevTools Protocol (CDP) methods over the Vitest browser WebSocket RPC. CDP is not gated by `browser.api.allowWrite`, `browser.api.allowExec`, `api.allowWrite`, or `api.allowExec`. As a result, disabling Browser Mode write and exec operations does not prevent a browser API client from using CDP to perform equivalent actions. In a verified reproduction with `allowWrite: false` and `allowExec: false`, CDP `Page.setDownloadBehavior` set the browser download directory to the project root, and CDP `Runtime.evaluate` down

    CVE: CVE-2026-53633

  • GHSA-2h32-95rg-cpppCritical
    Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
    • >= 4.0.17, < 4.1.6
    • >= 5.0.0-beta.0, < 5.0.0-beta.3
    GitHub (opens in a new tab)

    ## Summary Vitest browser mode served `/__vitest_test__/` with the `otelCarrier` query parameter inserted directly into an inline module script. Because this value was treated as JavaScript source rather than data, an attacker could craft a browser-runner URL that executes arbitrary JavaScript in the Vitest server origin. https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/node/serverOrchestrator.ts#L48 https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/client/public/esm-client-injector.

    CVE: CVE-2026-47428

  • GHSA-8gvc-j273-4wm5Moderate
    Vitest browser mode serves arbitrary files
    • >= 2.0.4, < 2.1.9
    • >= 3.0.0, < 3.0.4
    GitHub (opens in a new tab)

    ### Summary `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by [`browser.api.host: true`](https://vitest.dev/guide/browser/config.html#browser-api), an attacker can send a request to that handler from remote to get the content of arbitrary files. ### Details This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130

    CVE: CVE-2025-24963

Showing 1-5 of 5 vulnerabilities