Vulnerability Intelligence Report
Vitest: Browser Mode provider commands bypass the file-access permission gate
CVE-2026-73653
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWrite permission gate or confining paths to the project root. A client that can reach the Browser Mode API can read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process even when allowWrite is false. This issue is fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6.
Path Traversal
No Active Exploit Signals
CVSS Base Score
9.4
CRITICAL
Exploitability:3.9
Impact Score:5.5
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| vitest-dev | vitest | < 3.2.7 (affected), >= 4.0.0, < 4.1.10 (affected), >= 5.0.0-beta.1, < 5.0.0-beta.6 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
GitHub Advisory
Vulnerability Class
Path Traversal
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | GitHub, Inc. · Vendor · USA |
| Reserved | 2026-08-13T14:04:09 |
| Published | 2026-08-13T18:19:00 |
| Last Updated | 2026-08-13T18:42:42 |
Community Chatter & Buzz