@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.5), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.5) +1 more potentially affected by CVE-2026-73653 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.5)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.5 Source cves: CVE-2026-73653 Source advisory: MEND:CVE-2026-73653...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.5), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.5) +1 more potentially affected by CVE-2026-73653 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.5)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.5 Source cves: CVE-2026-73653 Source advisory: GHSA-P63J-VCC4-9VMV...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.5), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.5) +1 more potentially affected by CVE-2026-73653 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.5)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.5 Source cves: CVE-2026-73653 Source advisory: OSV:GHSA-P63J-VCC4-9VMV...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.5), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.5) +1 more potentially affected by unknown CVE via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.5)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.5 Source cves: unknown CVE Source advisory: SNYK:JS-VITESTBROWSER-18171374...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.3), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.3) +1 more potentially affected by CVE-2026-53633 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.3)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.3 Source cves: CVE-2026-53633 Source advisory: MEND:CVE-2026-53633...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.2), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.2) +1 more potentially affected by CVE-2026-47428 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.2)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.2 Source cves: CVE-2026-47428 Source advisory: MEND:CVE-2026-47428...

@aamini/config (>=0.0.1, <=0.0.13), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.278, <=2.1.0-alpha.281) +9 more potentially affected by CVE-2026-47428 via @vitest/browser (>=4.0.17, <=4.1.5)

@vitest/browser NPM version =4.0.17, =0.0.1, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =4.0.17, =4.0.17, =4.0.17, =0.6.0-rc.1, =0.1.18, =0.2.2 Source cves: CVE-2026-47428 Source advisory: MEND:CVE-2026-47428...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.3), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.3) +1 more potentially affected by CVE-2026-53633 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.3)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.3 Source cves: CVE-2026-53633 Source advisory: SNYK:JS-VITESTBROWSER-17375130...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.3), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.3) +1 more potentially affected by CVE-2026-53633 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.3)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.3 Source cves: CVE-2026-53633 Source advisory: OSV:GHSA-G8MR-85JM-7XHM...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.3), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.3) +1 more potentially affected by CVE-2026-53633 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.3)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.3 Source cves: CVE-2026-53633 Source advisory: GHSA-G8MR-85JM-7XHM...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.2), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.2) +1 more potentially affected by CVE-2026-47428 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.2)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.2 Source cves: CVE-2026-47428 Source advisory: GHSA-2H32-95RG-CPPP...

CVE-2026-25244

A flaw was found in WebdriverIO. A remote attacker can exploit a command injection vulnerability by crafting a malicious Git repository with a specially named branch. This branch name, containing shell metacharacters, is unsafely processed during test orchestration. This allows for remote code...

WebdriverIO Framework Code Execution

The vulnerability of the WebdriverIO framework is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-25244

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution RCE in test orchestration. Git permits branch names containing shell...

CVE-2026-25244 WebdriverIO has Command Injection in the BrowserStack Service

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution RCE in test orchestration. Git permits branch names containing shell...

EUVD-2026-30805

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution RCE in test orchestration. Git permits branch names containing shell...

CVE-2026-25244 WebdriverIO has Command Injection in the BrowserStack Service

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution RCE in test orchestration. Git permits branch names containing shell...

CVE-2026-25244

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution RCE in test orchestration. Git permits branch names containing shell...

CVE-2026-25244 WebdriverIO has Command Injection in the BrowserStack Service

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution RCE in test orchestration. Git permits branch names containing shell...

CVE-2026-25244

CVE-2026-25244 affects WebdriverIO versions below 9.24.0, specifically the @wdio/browserstack-service during test orchestration. The root cause is user-controlled git branch names being interpolated directly into execSync() calls within getGitMetadataForAISelection() without sanitization, enablin...