@baic/yolk-test (>=2.1.0-alpha.278, <=2.1.0-alpha.282), @cosyte/process (>=0.0.1, <=0.1.0) +19 more potentially affected by CVE-2026-53633 via @vitest/coverage-v8 (>=4.0.2, <=4.1.7)

@vitest/coverage-v8 NPM version =4.0.2, =2.1.0-alpha.278, =0.0.1, =21.0.0-alpha.33, =1.0.1, =2.0.1, =2.0.1, =0.1.0, =1.2.0-alpha.35, =1.11.0, =1.29.1-beta.3, =0.1.3, =1.10.0, =1.12.2-e9b71a0.9 and more Source cves: CVE-2026-53633 Source advisory: SNYK:JS-VITESTCOVERAGEV8-17375132...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @aklesky/vitest-config (1.0.2) +32 more potentially affected by CVE-2026-53633 via @vitest/coverage-v8 (>=3.0.3, <=3.2.4)

@vitest/coverage-v8 NPM version =3.0.3, =0.0.1, =1.0.388, =0.13.0, =2.2.0-app-13.13.1, =21.0.0-alpha.26, =4.0.9, =3.5.49, =5.1.3, =40.1.0, =3.0.9, =3.0.0, =3.1.4 and more Source cves: CVE-2026-53633 Source advisory: SNYK:JS-VITESTCOVERAGEV8-17375132...

Missing Authorization

Overview @vitest/coverage-v8 is a V8 coverage provider for Vitest Affected versions of this package are vulnerable to Missing Authorization in the cdp API exposed by the browser WebSocket RPC, which allows forwarding of raw Chrome DevTools Protocol methods without proper enforcement of write and...