Missing Authorization

Overview vitest is a Next generation testing framework powered by Vite Affected versions of this package are vulnerable to Missing Authorization in the cdp API exposed by the browser WebSocket RPC, which allows forwarding of raw Chrome DevTools Protocol methods without proper enforcement of write...

Missing Authorization

Overview @vitest/browser is a Browser running for Vitest Affected versions of this package are vulnerable to Missing Authorization in the cdp API exposed by the browser WebSocket RPC, which allows forwarding of raw Chrome DevTools Protocol methods without proper enforcement of write and exec...

Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

Summary Vitest Browser Mode exposes a cdp API that forwards raw Chrome DevTools Protocol CDP methods over the Vitest browser WebSocket RPC. CDP is not gated by browser.api.allowWrite, browser.api.allowExec, api.allowWrite, or api.allowExec. As a result, disabling Browser Mode write and exec...

GHSA-G8MR-85JM-7XHM Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

Summary Vitest Browser Mode exposes a cdp API that forwards raw Chrome DevTools Protocol CDP methods over the Vitest browser WebSocket RPC. CDP is not gated by browser.api.allowWrite, browser.api.allowExec, api.allowWrite, or api.allowExec. As a result, disabling Browser Mode write and exec...

NPM: Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

NPM: Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE vulnerability discovered by ? in WordPress Npm vite-plus versions = 0.1.23...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.249, <=2.1.0-alpha.251) +7 more potentially affected by CVE-2026-53633 via @vitest/browser (>=3.0.5, <=3.2.4)

@vitest/browser NPM version =3.0.5, =0.0.1, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =3.8.0, =1.0.1, =0.0.2, =0.0.5 Source cves: CVE-2026-53633 Source advisory: OSV:GHSA-G8MR-85JM-7XHM...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.3), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.3) +1 more potentially affected by CVE-2026-53633 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.3)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.3 Source cves: CVE-2026-53633 Source advisory: OSV:GHSA-G8MR-85JM-7XHM...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.3), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.3) +1 more potentially affected by CVE-2026-53633 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.3)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.3 Source cves: CVE-2026-53633 Source advisory: SNYK:JS-VITESTBROWSER-17375130...

@baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.278, <=2.1.0-alpha.281), @baic/preset-yolk-umi-mobile (>=2.1.0-alpha.278, <=2.1.0-alpha.281) +23 more potentially affected by CVE-2026-53633 via @vitest/coverage-v8 (>=4.0.2, <=4.1.7)

@vitest/coverage-v8 NPM version =4.0.2, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =0.0.1, =21.0.0-alpha.33, =1.0.1, =2.0.1, =2.0.1, =0.1.0, =1.2.0-alpha.35, =1.5.0-alpha.29 - @planvokter/riotplan-e2e 1.0.2-dev.0 - @planvokter/riotplan-mcp-http 1.1.4...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.249, <=2.1.0-alpha.251) +7 more potentially affected by CVE-2026-53633 via @vitest/browser (>=3.0.5, <=3.2.4)

@vitest/browser NPM version =3.0.5, =0.0.1, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =3.8.0, =1.0.1, =0.0.2, =0.0.5 Source cves: CVE-2026-53633 Source advisory: SNYK:JS-VITESTBROWSER-17375130...

@aamini/config (>=0.0.1, <=0.0.13), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.278, <=2.1.0-alpha.281) +9 more potentially affected by CVE-2026-53633 via @vitest/browser (>=4.0.0, <=4.1.7)

@vitest/browser NPM version =4.0.0, =0.0.1, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =4.0.0, =4.0.0, =4.0.0, =0.5.0, =0.1.13, =0.2.2 Source cves: CVE-2026-53633 Source advisory: GHSA-G8MR-85JM-7XHM...

@aamini/config (>=0.0.1, <=0.0.13), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.278, <=2.1.0-alpha.281) +9 more potentially affected by CVE-2026-53633 via @vitest/browser (>=4.0.0-beta.7, <=4.1.7)

@vitest/browser NPM version =4.0.0-beta.7, =0.0.1, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =4.0.0-beta.15, =4.0.0-beta.15, =4.0.0-beta.15, =0.5.0-rc.1, =0.1.0, =0.2.2 Source cves: CVE-2026-53633 Source advisory: SNYK:JS-VITESTBROWSER-17375130...

@aamini/config (>=0.0.1, <=0.0.13), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.278, <=2.1.0-alpha.281) +9 more potentially affected by CVE-2026-53633 via @vitest/browser (>=4.0.0, <=4.1.7)

@vitest/browser NPM version =4.0.0, =0.0.1, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =4.0.0, =4.0.0, =4.0.0, =0.5.0, =0.1.13, =0.2.2 Source cves: CVE-2026-53633 Source advisory: OSV:GHSA-G8MR-85JM-7XHM...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.3), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.3) +1 more potentially affected by CVE-2026-53633 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.3)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.3 Source cves: CVE-2026-53633 Source advisory: GHSA-G8MR-85JM-7XHM...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @aklesky/vitest-config (1.0.2) +32 more potentially affected by CVE-2026-53633 via @vitest/coverage-v8 (>=3.0.3, <=3.2.4)

@vitest/coverage-v8 NPM version =3.0.3, =0.0.1, =1.0.388, =0.13.0, =2.2.0-app-13.13.1, =21.0.0-alpha.26, =4.0.9, =3.5.49, =5.1.3, =40.1.0, =3.0.9, =3.0.0, =3.1.4 and more Source cves: CVE-2026-53633 Source advisory: SNYK:JS-VITESTCOVERAGEV8-17375132...

@aamini/config (>=0.0.1, <=0.0.13), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.278, <=2.1.0-alpha.281) +6 more potentially affected by CVE-2026-53633 via @vitest/browser-playwright (>=4.0.18, <=4.1.5)

@vitest/browser-playwright NPM version =4.0.18, =0.0.1, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =0.6.0-rc.1, =0.2.0-alpha.1, =0.2.2 Source cves: CVE-2026-53633 Source advisory: SNYK:JS-VITESTBROWSERPLAYWRIGHT-17375133...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @24hr/ettapi (>=0.2.4, <=0.2.5) +100 more potentially affected by CVE-2026-53633 via vitest (>=3.0.2, <=3.2.4)

vitest NPM version =3.0.2, =0.0.1, =0.2.4, =0.5.0, =2.2.1, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =0.0.0, =4.0.0-alpha.5, =0.1.2-next.95, =1.0.0, =1.0.2 - @chrom-ar/solver-sdk 1.0.2 and more Source cves: CVE-2026-53633 Source advisory:...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.249, <=2.1.0-alpha.251) +7 more potentially affected by CVE-2026-53633 via @vitest/browser (>=3.0.5, <=3.2.4)

@vitest/browser NPM version =3.0.5, =0.0.1, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =3.8.0, =1.0.1, =0.0.2, =0.0.5 Source cves: CVE-2026-53633 Source advisory: GHSA-G8MR-85JM-7XHM...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.2), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.2) +1 more potentially affected by CVE-2026-47428 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.2)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.2 Source cves: CVE-2026-47428 Source advisory: GHSA-2H32-95RG-CPPP...