CVE-2026-73653

Received Received - Intake

Arbitrary File Read and Write in Vitest Browser Mode

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWrite permission gate or confining paths to the project root. A client that can reach the Browser Mode API can read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process even when allowWrite is false. This issue is fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73653

EUVD

EUVD-2026-58197

Affected Vendors & Products

Vendor	Product	Version / Range
vitest	vitest	to 3.2.7 (inc)
vitest	vitest	to 4.1.10 (inc)
vitest	vitest	to 5.0.0-beta.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-552	The product makes files or directories accessible to unauthorized actors, even though they should not be.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Vitest's Browser Mode allows certain commands to bypass file system access restrictions. Commands like upload, takeScreenshot, and deleteTracing accept user-supplied file paths without proper validation. This enables attackers to read, create, overwrite, or delete files anywhere the Vitest process can access, even when write permissions are disabled.

Detection Guidance

Detecting this vulnerability requires checking if Vitest Browser Mode is running with outdated versions (below 3.2.7, 4.1.10, or 5.0.0-beta.6). Inspect Vitest logs for file system operations like screenshots, uploads, or trace handling without proper permission checks. Look for unauthorized file access attempts in system logs.

Impact Analysis

If you use Vitest's Browser Mode API in a network-accessible environment, an attacker could exploit this to access sensitive files, modify or delete critical system files, or plant malicious files. This could lead to data breaches, system compromise, or service disruption depending on the Vitest process permissions.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to personal data files and HIPAA by allowing exposure or modification of protected health information. It undermines data integrity and confidentiality requirements in both regulations.

Mitigation Strategies

Upgrade Vitest to versions 3.2.7, 4.1.10, or 5.0.0-beta.6 or later. Disable Browser Mode API if not needed. Restrict network access to Vitest processes. Review file system permissions for the Vitest process to limit exposure.

Hi! I’m here to help you understand CVE-2026-73653. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70