CVE-2026-53633

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score

9.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H                                    

Vulnerability Description

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.

Vulnerability Details

Published Date

June 15, 2026

Last Modified

July 16, 2026

CWE ID

CWE-749

Source

GitHub

Vendor

npm

Product

@vitest/browser

External References

https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm
https://github.com/advisories/GHSA-g8mr-85jm-7xhm

CVE-2026-53633

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment