CVE-2026-53633

The record

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.

Affected packages

Related vulnerabilities

• GHSA-g8mr-85jm-7xhm Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files… Same vulnerability
• CVE-2026-47428 Vitest is a testing framework powered by Vite. Also affects @vitest/browser
• GHSA-2h32-95rg-cppp Vitest browser mode serves unsanitized otelCarrier query parameter as inline script Also affects @vitest/browser
• CVE-2026-53571 Vite is a frontend tooling framework for JavaScript. Also affects vite-plus
• CVE-2026-53632 launch-editor allows users to open files with line numbers in editor from Node.js. Also affects vite-plus
• GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows Also affects vite-plus
• GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths Also affects vite-plus
• CVE-2026-41211 Vite+ is a unified toolchain and entry point for web development. Also affects vite-plus