{"items":[{"id":"NVI-00015088","kind":"vulnerability","title":"Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-g8mr-85jm-7xhm","CVE-2026-53633"],"plain_summary":"GitHub lists this reviewed advisory for @vitest/browser, @vitest/browser, @vitest/browser, vite-plus. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1ddda74321fdf552867136352d45a877"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-13T18:19:32.000Z","value":"9.8 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-1ddda74321fdf552867136352d45a877"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1ddda74321fdf552867136352d45a877","url":"https://github.com/advisories/GHSA-g8mr-85jm-7xhm","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-g8mr-85jm-7xhm","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:16:47.162Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1ddda74321fdf552867136352d45a877"],"technology":"@vitest/browser","known_exclusions":[],"conditions_summary":"## Summary\n\nVitest Browser Mode exposes a `cdp()` API that forwards raw Chrome DevTools Protocol (CDP) methods over the Vitest browser WebSocket RPC. CDP is not gated by `browser.api.allowWrite`, `browser.api.allowExec`, `api.allowWrite`, or `api.allowExec`.\n\nAs a result, disabling Browser Mode write and exec operations does not prevent a browser API client from using CDP to perform equivalent actions. In a verified reproduction with `allowWrite: false` and `allowExec: false`, CDP `Page.setDownloadBehavior` set the browser download directory to the project root, and CDP `Runtime.evaluate` downloaded a controlled `vite.config.ts`. Vitest reloaded the changed config and executed attacker-controlled Node.js code.\n\nWhen the Browser Mode API is also exposed to the network, this becomes remotely exploitable because the generated browser runner page exposes the API token, active session id, project name, and project root path needed to connect to the browser WebSocket API and select the target download directory.\n\n## Impact\n\nThis affects Browser Mode projects using a CDP-capable provider, such as Playwright Chromium, when the browser API server is exposed to the network, for example with ","public_affected_ranges":[">= 5.0.0-beta.0, <= 5.0.0-beta.3"]},{"certainty":"source_listed","source_ids":["sr-1ddda74321fdf552867136352d45a877"],"technology":"@vitest/browser","known_exclusions":[],"conditions_summary":"## Summary\n\nVitest Browser Mode exposes a `cdp()` API that forwards raw Chrome DevTools Protocol (CDP) methods over the Vitest browser WebSocket RPC. CDP is not gated by `browser.api.allowWrite`, `browser.api.allowExec`, `api.allowWrite`, or `api.allowExec`.\n\nAs a result, disabling Browser Mode write and exec operations does not prevent a browser API client from using CDP to perform equivalent actions. In a verified reproduction with `allowWrite: false` and `allowExec: false`, CDP `Page.setDownloadBehavior` set the browser download directory to the project root, and CDP `Runtime.evaluate` downloaded a controlled `vite.config.ts`. Vitest reloaded the changed config and executed attacker-controlled Node.js code.\n\nWhen the Browser Mode API is also exposed to the network, this becomes remotely exploitable because the generated browser runner page exposes the API token, active session id, project name, and project root path needed to connect to the browser WebSocket API and select the target download directory.\n\n## Impact\n\nThis affects Browser Mode projects using a CDP-capable provider, such as Playwright Chromium, when the browser API server is exposed to the network, for example with ","public_affected_ranges":[">= 4.0.0, <= 4.1.7"]},{"certainty":"source_listed","source_ids":["sr-1ddda74321fdf552867136352d45a877"],"technology":"@vitest/browser","known_exclusions":[],"conditions_summary":"## Summary\n\nVitest Browser Mode exposes a `cdp()` API that forwards raw Chrome DevTools Protocol (CDP) methods over the Vitest browser WebSocket RPC. CDP is not gated by `browser.api.allowWrite`, `browser.api.allowExec`, `api.allowWrite`, or `api.allowExec`.\n\nAs a result, disabling Browser Mode write and exec operations does not prevent a browser API client from using CDP to perform equivalent actions. In a verified reproduction with `allowWrite: false` and `allowExec: false`, CDP `Page.setDownloadBehavior` set the browser download directory to the project root, and CDP `Runtime.evaluate` downloaded a controlled `vite.config.ts`. Vitest reloaded the changed config and executed attacker-controlled Node.js code.\n\nWhen the Browser Mode API is also exposed to the network, this becomes remotely exploitable because the generated browser runner page exposes the API token, active session id, project name, and project root path needed to connect to the browser WebSocket API and select the target download directory.\n\n## Impact\n\nThis affects Browser Mode projects using a CDP-capable provider, such as Playwright Chromium, when the browser API server is exposed to the network, for example with ","public_affected_ranges":[">= 3.0.0, <= 3.2.4"]},{"certainty":"source_listed","source_ids":["sr-1ddda74321fdf552867136352d45a877"],"technology":"vite-plus","known_exclusions":[],"conditions_summary":"## Summary\n\nVitest Browser Mode exposes a `cdp()` API that forwards raw Chrome DevTools Protocol (CDP) methods over the Vitest browser WebSocket RPC. CDP is not gated by `browser.api.allowWrite`, `browser.api.allowExec`, `api.allowWrite`, or `api.allowExec`.\n\nAs a result, disabling Browser Mode write and exec operations does not prevent a browser API client from using CDP to perform equivalent actions. In a verified reproduction with `allowWrite: false` and `allowExec: false`, CDP `Page.setDownloadBehavior` set the browser download directory to the project root, and CDP `Runtime.evaluate` downloaded a controlled `vite.config.ts`. Vitest reloaded the changed config and executed attacker-controlled Node.js code.\n\nWhen the Browser Mode API is also exposed to the network, this becomes remotely exploitable because the generated browser runner page exposes the API token, active session id, project name, and project root path needed to connect to the browser WebSocket API and select the target download directory.\n\n## Impact\n\nThis affects Browser Mode projects using a CDP-capable provider, such as Playwright Chromium, when the browser API server is exposed to the network, for example with ","public_affected_ranges":["<= 0.1.23"]}],"null_published_at":"2026-11-03T10:03:26.546Z","source_updated_at":"2026-08-13T18:19:32.000Z","source_disclosed_at":"2026-06-15T20:05:15.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T20:16:47.162Z"}],"next_cursor":null,"snapshot_revision":"42594"}