Executive brief
Vitest is a testing framework for web applications. A vulnerability in its Browser Mode allows an attacker to bypass security restrictions and access the local file system of the machine running the tests. This could lead to the theft of sensitive files, or the unauthorized creation and deletion of files, potentially disrupting development operations or exposing private data.
Technical details
A path traversal and authorization bypass vulnerability exists in @vitest/browser's Browser Mode. Several built-in commands (such as upload, takeScreenshot, and deleteTracing) that run on the Node.js side fail to validate the 'allowWrite' permission gate and do not confine file paths to the project directory. An attacker who can reach the Browser Mode API (e.g., when test.api.host is exposed) can use absolute paths or '../' sequences to read, create, overwrite, or delete arbitrary files accessible to the Vitest process. The vulnerability is particularly severe when the API is exposed to the network, as it bypasses the default security configurations intended to block such access. Patches are available in versions 3.2.7, 4.1.10, and 5.0.0-beta.6.
Affected products
- vitest-dev @vitest/browser < 3.2.7, >= 4.0.0, < 4.1.10, >= 5.0.0-beta.1, < 5.0.0-beta.6
Timeline
- 2026-07-08: disclosed
- 2026-07-21: advisory