Vitest
Monthly
Path traversal in Vitest Browser Mode (@vitest/browser) lets any client reachable via the Browser Mode API read, create, overwrite, or delete arbitrary files on the host running the test process, bypassing the allowWrite permission gate entirely. Affected are Vitest before 3.2.7, 4.x before 4.1.10, and the 5.0.0-beta line before 5.0.0-beta.6, where provider commands (upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, annotateTraces) accept browser-supplied paths without confining them to the project root. There is no public exploit identified at time of analysis and it is not in CISA KEV; the highest-impact primitive is the upload command's arbitrary file read.
Vitest is a testing framework powered by Vite. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vitest is a testing framework powered by Vite. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Epss exploitation probability 18.8%.
Path traversal in Vitest Browser Mode (@vitest/browser) lets any client reachable via the Browser Mode API read, create, overwrite, or delete arbitrary files on the host running the test process, bypassing the allowWrite permission gate entirely. Affected are Vitest before 3.2.7, 4.x before 4.1.10, and the 5.0.0-beta line before 5.0.0-beta.6, where provider commands (upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, annotateTraces) accept browser-supplied paths without confining them to the project root. There is no public exploit identified at time of analysis and it is not in CISA KEV; the highest-impact primitive is the upload command's arbitrary file read.
Vitest is a testing framework powered by Vite. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vitest is a testing framework powered by Vite. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Epss exploitation probability 18.8%.