Critical
Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Type: advisorySources: OSV
Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-53633
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 23:06 UTC · Revision 1
Source evidence
Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
core-osv · Original sourcePublished 14 Jul 2026, 19:35 UTC
Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.
osv:CVE-2026-53633
Complete source record
{
"id": "6de04ed1747751c94b7287e8d0238a09efe1e559468a36789bf6066cc16158a1",
"url": "https://osv.dev/vulnerability/CVE-2026-53633",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE",
"summary": "Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.",
"evidence": "osv:CVE-2026-53633",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2026-53633",
"aliases": [
"CVE-2026-53633",
"GHSA-g8mr-85jm-7xhm"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/vitest-dev/vitest",
"type": "GIT",
"events": [
{
"introduced": "01600e04c2252abee78fc8a695197ce62f2846d4"
},
{
"fixed": "2cbad0a923c48c6144266df3cd25f93547cb5221"
},
{
"introduced": "da7ce1712fd4d0e4e807ec01ce755581e6892d5b"
},
{
"fixed": "e61f2dd2a0ba0a266c1c5e0334aad3799fee527f"
},
{
"introduced": "0"
},
{
"fixed": "90569f5b6ac33d0a5602672e8cfb8dc9fcdb99b3"
},
{
"fixed": "385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7"
},
{
"fixed": "63e3b2eee4d58da56786a6333f517b9b492528c7"
},
{
"fixed": "e4067b3b150005fd42cf75f994300119245806b9"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "5.0.0-beta.0"
},
{
"fixed": "5.0.0-beta.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "63e3b2eee4d58da56786a6333f517b9b492528c7"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "e4067b3b150005fd42cf75f994300119245806b9"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "2cbad0a923c48c6144266df3cd25f93547cb5221"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v3.2.5"
},
{
"range": [
{
"fixed": "e61f2dd2a0ba0a266c1c5e0334aad3799fee527f"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v4.1.8"
},
{
"range": [
{
"fixed": "90569f5b6ac33d0a5602672e8cfb8dc9fcdb99b3"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v5.0.0-beta.4"
}
]
}
}
],
"versions": [
"v4.1.7",
"v4.1.6",
"v5.0.0-beta.3",
"v5.0.0-beta.2",
"v4.1.5",
"v5.0.0-beta.1",
"v4.1.4",
"v4.1.3",
"v4.1.2",
"v4.1.1",
"v4.1.0",
"v4.1.0-beta.6",
"v4.1.0-beta.5",
"v4.1.0-beta.4",
"v4.1.0-beta.3",
"v4.0.17",
"v4.1.0-beta.2",
"v4.1.0-beta.1",
"v4.0.16",
"v4.0.15",
"v4.0.14",
"v4.0.13",
"v4.0.12",
"v4.0.11",
"v4.0.10",
"v4.0.9",
"v4.0.8",
"v4.0.7",
"v4.0.6",
"v4.0.5",
"v4.0.4",
"v4.0.3",
"v4.0.2",
"v4.0.1",
"v4.0.0",
"v3.2.4",
"v3.2.3",
"v3.2.2",
"v3.2.1",
"v3.2.0",
"v3.2.0-beta.3",
"v3.1.3",
"v3.2.0-beta.2",
"v3.2.0-beta.1",
"v3.1.2",
"v3.1.1",
"v3.1.0",
"v3.1.0-beta.2",
"v3.1.0-beta.1",
"v3.0.9",
"v3.0.8",
"v3.0.7",
"v3.0.6",
"v3.0.5",
"v3.0.4",
"v3.0.3",
"v3.0.2",
"v3.0.1",
"v3.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53633.json"
}
}
],
"modified": "2026-10-28T02:30:24.153795170Z",
"provider": "osv",
"references": [
"https://github.com/vitest-dev/vitest/releases/tag/v3.2.5",
"https://github.com/vitest-dev/vitest/releases/tag/v4.1.8",
"https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.4",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53633.json",
"https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm",
"https://nvd.nist.gov/vuln/detail/CVE-2026-53633",
"https://github.com/vitest-dev/vitest/commit/385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7",
"https://github.com/vitest-dev/vitest/commit/63e3b2eee4d58da56786a6333f517b9b492528c7",
"https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9",
"https://github.com/vitest-dev/vitest/pull/10444",
"https://github.com/vitest-dev/vitest/pull/10450",
"https://github.com/vitest-dev/vitest/pull/10456"
],
"provider_metadata": {
"cwe_ids": [
"CWE-749",
"CWE-862"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53633.json"
}
},
"related_cves": [
{
"value": "CVE-2026-53633",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 490727,
"published_at": "2026-07-14T19:35:42.739+00:00"
}