Vitest Browser Mode - Local File Read

Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host- true, an attacker can send a request to that handler from remote to get th...

EUVD-2026-105143

Vitest: Servers misapply server.fs.deny, serving .env, private keys, .git, and the API token file...

CVE-2026-112948

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...

CVE-2026-112948

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...

CVE-2026-112948 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...

CVE-2026-112948

The Vitest testing framework (versions 5.0.0-beta.6 through 5.0.5 ) contains a vulnerability where dev servers misapply server.fs.deny. The root cause is that project servers replace Vite's defaults, and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker reachi...

CVE-2026-112948 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...

CVE-2026-112948 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...

PT-2026-118430

Name of the Vulnerable Software and Affected Versions Vitest versions 5.0.0-beta.6 through 5.0.4 Description Dev servers may misapply server.fs.deny because project servers replace defaults and the root server adds .vitest-secret-token after the matcher is compiled. An attacker with access to an...

CVE-2026-73653

A flaw was found in Vitest. A remote attacker, by sending specially crafted commands to the Browser Mode API, could bypass file access restrictions. This allows the attacker to read, create, overwrite, or delete arbitrary files on the system where Vitest is running, even when file write permissio...

CVE-2026-73653 Vitest: Browser Mode provider commands bypass the file-access permission gate

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

CVE-2026-73653 Vitest: Browser Mode provider commands bypass the file-access permission gate

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

CVE-2026-73653

Vitest (framework powered by Vite) has a vulnerability in Browser Mode provider commands prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6. The commands—upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces—accept browser-supplied file paths without enforcin...

EUVD-2026-58197

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

PT-2026-71737

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

CVE-2026-73653: Improper Limitation of a Pathname to a Restricted Directory

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

GHSA-P63J-VCC4-9VMV @vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem taking screenshots, managing Playwright traces, uploading files for , comparing screenshots. Several of these commands accept a file path from the browser a...

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem taking screenshots, managing Playwright traces, uploading files for , comparing screenshots. Several of these commands accept a file path from the browser a...

Missing Authorization

Overview @vitest/browser is a Browser running for Vitest Affected versions of this package are vulnerable to Missing Authorization through the built-in browser commands in @vitest/browser and the browser provider RPC handlers. An attacker can read, create, overwrite, or delete local files by...

Missing Authorization

Overview @vitest/browser-webdriverio is a Browser running for Vitest using webdriverio Affected versions of this package are vulnerable to Missing Authorization through the built-in browser commands in @vitest/browser and the browser provider RPC handlers. An attacker can read, create, overwrite,...