Vitest CVE-2026-73653

Exploitation requires network reachability to the Browser Mode API - specifically a non-default configuration where test.api.host is set or the Vite dev server is otherwise reachable from another machine or origin (the localhost-only default leaves no untrusted party in position). Given that reachability, no authentication is needed (CVSS PR:N) and no user interaction, and the flaw works even with allowWrite:false because the vulnerable upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces commands never consult that gate. Limiting factors: the target must run an affected @vitest/browser version (<3.2.7, 4.0.0-4.1.9, or 5.0.0-beta.1-beta.5) with Browser Mode enabled and network-exposed; write/delete operations cannot set attacker-chosen file contents (only PNG/trace outputs), so weaponization beyond overwrite/delete/read is constrained.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, base 9.4) portrays a network, unauthenticated, no-interaction attack with high confidentiality/integrity impact - a critical rating. However, the vendor advisory materially qualifies this: exploitation only matters when the Browser Mode API is exposed beyond localhost (e.g. test.api.host set or the dev server reachable from another origin/machine), and on a default localhost-only setup with trusted test code there is no untrusted party positioned to exploit it. The AV:N is therefore accurate only for the non-default network-exposed configuration; in the common local case real-world risk is much lower than 9.4 implies. No EPSS score, KEV entry, or SSVC decision was provided, and no public exploit is identified, so there is no signal of active or automatable exploitation. Note also that the write/delete primitives cannot place attacker-chosen content (they emit PNGs or trace zips), so the I:H reflects arbitrary create/overwrite/delete rather than payload injection; the truly serious primitive is arbitrary file read via upload/annotateTraces. Overall: a genuine critical for internet- or LAN-exposed Browser Mode deployments and CI runners relying on allowWrite:false to sandbox untrusted test code, but low practical risk for standard local developer usage.

An attacker who can reach a network-exposed Vitest Browser Mode server (for example a CI runner or a dev machine where test.api.host has been set) sends a provider command such as upload referencing /etc/passwd or a CI secrets file; the Node side reads the file and loads its contents into the page where the attacker's test code exfiltrates it. The same access allows overwriting or deleting arbitrary files via takeScreenshot/stopChunkTrace/deleteTracing. No public exploit code is identified, and the attack requires the API to be reachable beyond localhost.