CVE-2026-53633

Awaiting Analysis Awaiting Analysis - Queue

Code Execution via CDP in Vitest Browser Mode

Publication date: 2026-07-14

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-29

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-53633

Affected Vendors & Products

Vendor	Product	Version / Range
vitest	vitest	to 3.2.5 (inc)
vitest	vitest	4.1.8
vitest	vitest	5.0.0-beta
vitest-dev	vitest	From 3.0.0 (inc) to 3.2.5 (inc)
vitest-dev	vitest	4.1.8
vitest-dev	vitest	5.0.0-beta

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-749	The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

Attack-Flow Graph

Executive Summary

This vulnerability affects Vitest Browser Mode versions 3.0.0 to 3.2.5, 4.1.8, and 5.0.0-beta.4. It exposes a cdp() API that forwards raw Chrome DevTools Protocol methods without proper restrictions. Attackers could use this to overwrite vite.config.ts files and execute arbitrary Node.js code via methods like Page.setDownloadBehavior and Runtime.evaluate.

Detection Guidance

Check Vitest Browser Mode versions between 3.0.0-3.2.4, 4.1.0-4.1.7, and 5.0.0-beta.0-beta.3 for exposed cdp() API. Inspect network traffic for unauthorized Chrome DevTools Protocol (CDP) requests like Page.setDownloadBehavior or Runtime.evaluate.

Impact Analysis

An attacker could gain full control over your Vitest environment, modify configuration files, and execute malicious code. This could lead to data breaches, system compromise, or unauthorized access to sensitive resources. The high CVSS score (9.8) indicates severe potential impact.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Vitest to versions 3.2.5, 4.1.8, or 5.0.0-beta.4 or later.
Disable Browser Mode in Vitest if not required.
Restrict network access to Vitest instances running in Browser Mode.

Hi! I’m here to help you understand CVE-2026-53633. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70