Critical severity · published Aug 13, 2026
CVE-2026-73653
Vitest: Browser Mode provider commands bypass the file-access permission gate
9.4
CVSS
0.8%
EPSS
No
On KEV
Description
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWrite permission gate or confining paths to the project root. A client that can reach the Browser Mode API can read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process even when allowWrite is false. This issue is fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
vitest · vitest-dev
< 3.2.7; >= 4.0.0, < 4.1.10; >= 5.0.0-beta.1, < 5.0.0-beta.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73653
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73653
github.com
https://github.com/vitest-dev/vitest/commit/33f96a145ef09ca6a43b4e555eb273e64a87be23
github.com
https://github.com/vitest-dev/vitest/commit/5c18dd267ff7f47f24cab2f615a16b37d90feb7f
github.com
https://github.com/vitest-dev/vitest/commit/b795e36b34969bec50b47a9f29d26f799a6a04fb
github.com
https://github.com/vitest-dev/vitest/pull/10674
github.com
https://github.com/vitest-dev/vitest/pull/10679
github.com
https://github.com/vitest-dev/vitest/pull/10680
More from vitest
9.8
CVE-2026-53633
Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
9.6
CVE-2026-47428
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
8.8
CVE-2025-24964
Vitest is a testing framework powered by Vite
7.5
CVE-2025-24963
Vitest is a testing framework powered by Vite
6.5
CVE-2026-112948
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file