CVE-2026-73653

What it actually does

Browser Mode provider commands accept unsanitized file paths from the client, bypassing the allowWrite gate and project-root confinement to enable arbitrary local file read, write, overwrite, or deletion within the privileges of the Vitest process.

Why it matters to the business

Test environments running affected Vitest versions can suffer unauthorized access to source code, secrets, or build artifacts, allowing data exfiltration or tampering that disrupts CI pipelines and exposes intellectual property.

How an attack unfolds

An attacker reachable to the Browser Mode API issues provider commands such as upload or takeScreenshot while supplying crafted paths containing traversal sequences; the missing permission and root checks cause the Vitest process to read, create, overwrite, or delete files outside the intended workspace.

How to fix it

Upgrade Vitest to 3.2.7, 4.1.10, or 5.0.0-beta.6 or later; restrict Browser Mode API exposure to trusted networks only; enforce allowWrite only for trusted users.

How to confirm the fix worked

Confirm the installed Vitest version meets or exceeds the fixed releases; attempt a provider command with a traversal path while allowWrite is false and verify the operation is rejected; review process permissions and network exposure of the test runner.

Typical attack path

1. Locate an exposed Vitest Browser Mode endpoint
2. Issue a provider command (upload, takeScreenshot, etc.) containing path traversal payloads
3. Read arbitrary files or write/overwrite files on the host
4. Delete trace or configuration files to impair testing or cover tracks

How to detect it

Inspect Vitest and Node process logs for provider commands containing path traversal sequences; correlate with file-system audit logs showing reads or writes outside the project directory; look for creation or deletion of unexpected image or trace files.

• vitest.*upload.*\.\./
• takeScreenshot.*\.\./
• screenshotMatcher.*\.\./
• stopChunkTrace.*\.\./
• deleteTracing.*\.\./
• annotateTraces.*\.\./

What your security team should do

• Immediately upgrade all Vitest installations to the fixed versions
• Disable or firewall Browser Mode endpoints in CI and developer environments
• Audit test-runner service accounts for least-privilege file access
• Add runtime monitoring for unexpected file operations originating from Vitest processes