File-access permission bypass in Vitest Browser Mode provider commands (CVE-2026-73653)

Several Browser Mode provider commands in Vitest accept browser-supplied file paths without enforcing the `allowWrite` permission gate or confining paths to the project root. A client able to reach the Browser Mode API can read arbitrary local files via the `upload` and `annotateTraces` commands, create or overwrite image and trace files via `takeScreenshot`, `screenshotMatcher`, and `stopChunkTrace`, or delete arbitrary files via `deleteTracing`, even when `allowWrite` is false. The risk is greatest when the Browser Mode API is exposed to the network. Affected versions: - <=3.2.6 - <=4.1.9 - <=5.0.0-beta.5 We recommend updating to: 3.2.7, 4.1.10, 5.0.0-beta.6. CVSS 9.4 · our assessment: act_now Reference: https://github.com/vitest-dev/vitest/security/advisories/GHSA-p63j-vcc4-9vmv Details: https://vuln.today/cve/CVE-2026-73653