Paper/Archive/CVE-2026-53633

CVE-2026-53633

vitest-dev vitest — Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 59.6.596 × 2011.9 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.

Affected

ProductAffectedFixed inSource

vitest>= 3.0.0, < 3.2.5–CNA

vitest>= 4.0.0, < 4.1.8–CNA

vitest>= 5.0.0-beta.0, < 5.0.0-beta.4–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References