Skip to main content

Vitest CVE-2026-73653

| EUVDEUVD-2026-58197 CRITICAL
Path Traversal (CWE-22)
2026-08-13 GitHub_M GHSA-p63j-vcc4-9vmv
Path Traversal Vitest
9.4
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
9.4 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
vuln.today AI
9.4 CRITICAL

Network-reachable API with no auth or interaction (AV:N/PR:N/UI:N); arbitrary file read gives C:H, create/overwrite/delete gives I:H, and file deletion yields limited A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

4
Patch available
Aug 13, 2026 - 19:04 EUVD
Source Code Evidence Fetched
Aug 13, 2026 - 19:02 vuln.today
Analysis Generated
Aug 13, 2026 - 19:02 vuln.today
CVE Published
Aug 13, 2026 - 18:19 cve.org
CRITICAL 9.4

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 3 npm packages depend on @vitest/browser (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWrite permission gate or confining paths to the project root. A client that can reach the Browser Mode API can read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process even when allowWrite is false. This issue is fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6.

AnalysisAI

Path traversal in Vitest Browser Mode (@vitest/browser) lets any client reachable via the Browser Mode API read, create, overwrite, or delete arbitrary files on the host running the test process, bypassing the allowWrite permission gate entirely. Affected are Vitest before 3.2.7, 4.x before 4.1.10, and the 5.0.0-beta line before 5.0.0-beta.6, where provider commands (upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, annotateTraces) accept browser-supplied paths without confining them to the project root. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach network-exposed Browser Mode API
Delivery
Send crafted provider command with traversal path
Exploit
Bypass allowWrite and project-root confinement
Execution
Read, overwrite, or delete arbitrary file
Impact
Exfiltrate secrets or tamper with host files
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network reachability to the Browser Mode API - specifically a non-default configuration where test.api.host is set or the Vite dev server is otherwise reachable from another machine or origin (the localhost-only default leaves no untrusted party in position). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, base 9.4) portrays a network, unauthenticated, no-interaction attack with high confidentiality/integrity impact - a critical rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach a network-exposed Vitest Browser Mode server (for example a CI runner or a dev machine where test.api.host has been set) sends a provider command such as upload referencing /etc/passwd or a CI secrets file; the Node side reads the file and loads its contents into the page where the attacker's test code exfiltrates it. The same access allows overwriting or deleting arbitrary files via takeScreenshot/stopChunkTrace/deleteTracing. …
Remediation Vendor-released patch: upgrade @vitest/browser to 3.2.7, 4.1.10, or 5.0.0-beta.6 depending on your major line, per the GHSA advisory (https://github.com/vitest-dev/vitest/security/advisories/GHSA-p63j-vcc4-9vmv) and the fix PRs https://github.com/vitest-dev/vitest/pull/10674 and https://github.com/vitest-dev/vitest/pull/10679. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Conduct immediate inventory of all Vitest deployments, identify instances using Browser Mode, and note current versions against vulnerability windows (before 3.2.7, 4.0.0-4.1.9, or 5.0.0-beta-5). …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Vitest

View all
CVE-2025-24964 CRITICAL POC
9.6 Feb 04

Vitest is a testing framework powered by Vite. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploi
CVE-2025-24963 MEDIUM POC
5.9 Feb 04

Vitest is a testing framework powered by Vite. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploita

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2026-73653 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy