npm package
@vitest/browser
pkg:npm/%40vitest/browser
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-53633 | Cri | 9.8 | >= 5.0.0-beta.0, < 5.0.0-beta.4 | 5.0.0-beta.4 | Jul 14, 2026 | Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browse | |
| CVE-2025-24963 | Med | 5.9 | >= 2.0.4, < 2.1.9 | 2.1.9 | Feb 4, 2025 | Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handle |
- affected >= 5.0.0-beta.0, < 5.0.0-beta.4fixed 5.0.0-beta.4
Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browse
- affected >= 2.0.4, < 2.1.9fixed 2.1.9
Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handle