Insecure Default Initialization of Resource

Overview @storybook/addon-vitest is a Storybook Vitest addon: Blazing fast component testing using stories Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not...

Insecure Default Initialization of Resource

Overview @storybook/core is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the resolved project config when usi...

Insecure Default Initialization of Resource

Overview @storybook/experimental-addon-test is an Integrate Vitest with Storybook Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the resolved...

CVE-2026-73653

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

CVE-2026-73653 Vitest: Browser Mode provider commands bypass the file-access permission gate

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

CVE-2026-73653 Vitest: Browser Mode provider commands bypass the file-access permission gate

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...