GHSA-g8mr-85jm-7xhm
Critical · 9.8CVSS
9.8
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @vitest/browser | 3.0.0 | 3.2.5 |
| npm | @vitest/browser | 4.0.0 | 4.1.8 |
| npm | @vitest/browser | 5.0.0-beta.0 | 5.0.0-beta.4 |
| npm | vite-plus | 0 | 0.1.24 |
Related vulnerabilities
- GHSA-2h32-95rg-cppp Vitest browser mode serves unsanitized otelCarrier query parameter as inline script Also affects @vitest/browser
- CVE-2026-53571 Vite is a frontend tooling framework for JavaScript. Also affects vite-plus
- CVE-2026-53632 launch-editor allows users to open files with line numbers in editor from Node.js. Also affects vite-plus
- GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows Also affects vite-plus
- GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths Also affects vite-plus
- CVE-2026-41211 Vite+ is a unified toolchain and entry point for web development. Also affects vite-plus
- GHSA-33r3-4whc-44c2 Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME Also affects vite-plus
- CVE-2026-20293 A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation… CWE-749