Original flaw
Earlier flawThe exposed Vitest browser RPC surface permitted remote filesystem writes and code execution.
Sink: Vitest packages/browser/src/node/rpc.ts write, exec, and CDP RPC handlers
Originally written by Vladimir
Vitest's AI-written code exposed an ungated CDP API, letting clients bypass disabled write/exec restrictions to achieve remote code execution.
How AI contributed: Incomplete remediationPublished Jun 15, 2026 in 
vitest-dev/vitest
Show full advisory descriptionHide advisory description
Summary Vitest Browser Mode exposes a cdp() API that forwards raw Chrome DevTools Protocol (CDP) methods over the Vitest browser WebSocket RPC. CDP is not gated by browser.api.allowWrite, browser.api.allowExec, api.allowWrite, or api.allowExec. As a result, disabling Browser Mode write and exec operations does not prevent a browser API client from using CDP to perform equivalent actions. In a verified reproduction with allowWrite: false and allowExec: false, CDP Page.setDownloadBehavior set the browser download directory to the project root, and CDP Runtime.evaluate downloaded a controlled vite.config.ts. Vitest reloaded the changed config and executed attacker-controlled Node.js code. When the Browser Mode API is also exposed to the network, this becomes remotely exploitable because the generated browser runner page exposes the API token, active session id, project name, and project root path needed to connect to the browser WebSocket API and select the target download directory. Impact This affects Browser Mode projects using a CDP-capable provider, such as Playwright Chromium, when the browser API server is exposed to the network, for example with --browser.api.host=0.0.0.0. In this mode Vitest warns that write and exec operations are disabled by default, but the generated browser runner page exposes enough metadata for a remote client to authenticate to the browser WebSocket API while an active session exists. This includes the browser API token, active session id, project name, and serialized test config including the project root path. The attacker can then call Vitest's CDP RPC and use Chrome's download controls to overwrite vite.config.ts in the project root. When Vitest reloads the changed config, attacker-controlled Node.js code executes on the host running Vitest. The same exposed CDP bridge also allows direct browser-session JavaScript execution through Runtime.evaluate. A separate local probe showed that CDP can navigate the browser to a file:// URL and read rendered file contents, but the primary verified impact is config-file overwrite leading to RCE. Reproduction For a concrete reproduction, start Browser Mode in watch mode using the official Lit example: Configure the Browser Mode API to listen on all interfaces while explicitly disabling write and exec operations: Then start the test server: Vitest serves the browser runner HTML and WebSocket API at http://localhost:63315. While the browser session is active: 1. Fetch the generated browser runner page: 2. Extract the embedded browser API token, active session id, project name, and project root: · window.VITEST_API_TOKEN · __vitest_browser_runner__.sessionId · __vitest_browser_runner__.config.name · __vitest_browser_runner__.config.root 3. Connect to the browser API WebSocket as a tester client: 4. Call the sendCdpEvent RPC method with: 5. Call sendCdpEvent again with Runtime.evaluate. The evaluated JavaScript creates a Blob containing a malicious Vite config and clicks an anchor element <a download="vite.config.ts">. 6. Observed result: · vite.config.ts is overwritten with attacker-controlled content. · Vitest reloads the changed config. · The injected Node.js payload runs on the host.
What actually happenedHide details
The debugger RPC path in packages/browser/src/node/rpc.ts was not gated by the allowWrite and allowExec flags that restrict the file commands, so a client could call Chrome DevTools Protocol methods like Page.setDownloadBehavior and Runtime.evaluate with both disabled. When the browser API is exposed to the network, the runner page leaks the API token and session id, and CDP can overwrite vite.config.ts so the reload executes attacker code.
Case facts
- CVE ID
- CVE-2026-53633
- GHSA ID
- GHSA-G8MR-85JM-7XHM
- Published
- Jun 15, 2026
- Severity
- CRITICAL
- Language
- JavaScript
- AI tool
ChatGPT/Codex- AI role
- Incomplete remediation
- Vulnerable release
- >= 5.0.0-beta.0, <= 5.0.0-beta.3
- Fixed release
- 5.0.0-beta.4
Only the highlighted steps are this advisory. The first step is the earlier flaw the AI tried, and failed, to close.
This advisoryCVE-2026-53633 (GHSA-G8MR-85JM-7XHM)
AI tried to fix this
Added api.allowWrite and api.allowExec gates to filesystem and test-execution RPC paths.
The AI-assisted change was a real security patch, but it left the same advisory reachable.
Missed: Left raw sendCdpEvent and trackCdpEvent handlers outside those gates.
Incomplete AI-assisted fix · ChatGPT/Codex
Fixed again
Added assertCdpAllowed to both raw CDP handlers and moved required coverage operations behind controlled commands.
This is the patch that actually stops the same attack path.
AI-assisted fix: ChatGPT/Codex · Hiroshi Ogawa
AI-assisted change
AI-assisted changepackages/ui/client/components/views/ViewEditor.vuesource vitest-dev/vitest@3a30e8712a+2−2
@@ -4,7 +4,7 @@ import type CodeMirror from 'codemirror' import type { ErrorWithDiff, File, TestAnnotation, TestError } from 'vitest' import { createTooltip, destroyTooltip } from 'floating-vue' import { getAttachmentUrl, sanitizeFilePath } from '~/composables/attachments'-import { client, isReport } from '~/composables/client'+import { client, config, isReport } from '~/composables/client' import { finished } from '~/composables/client/state' import { codemirrorRef } from '~/composables/codemirror'Show 10 hidden lines
import { openInEditor } from '~/composables/error'@@ -382,7 +382,7 @@ onBeforeUnmount(clearListeners) ref="editor" v-model="code" h-full- v-bind="{ lineNumbers: true, readOnly: isReport, saving }"+ v-bind="{ lineNumbers: true, readOnly: isReport || !config.api?.allowWrite, saving }" :mode="ext" data-testid="code-mirror" @save="onSave"Makes the browser file editor read-only whenever the resolved API disables writes, surfacing the new write restriction in the UI while the debugger-backed command path did not enforce that flag.
AI-assisted changepackages/vitest/src/node/config/resolveConfig.tssource vitest-dev/vitest@3a30e8712a+21−0
@@ -1,5 +1,6 @@ import type { ResolvedConfig as ResolvedViteConfig } from 'vite' import type { Vitest } from '../core'+import type { Logger } from '../logger' import type { BenchmarkBuiltinReporters } from '../reporters' import type { ResolvedBrowserOptions } from '../types/browser' import type {Show 41 hidden lines
@@ -59,6 +60,8 @@ function parseInspector(inspect: string | undefined | boolean | number) { export function resolveApiServerConfig<Options extends ApiConfig & UserConfig>( options: Options, defaultPort: number,+ parentApi?: ApiConfig,+ logger?: Logger, ): ApiConfig | undefined { let api: ApiConfig | undefined @@ -98,6 +101,22 @@ export function resolveApiServerConfig<Options extends ApiConfig & UserConfig>( api = { middlewareMode: true } } + if (!api.middlewareMode && api.host && api.host !== 'localhost' && api.host !== '127.0.0.1') {+ if (parentApi && api.allowWrite == null && api.allowExec == null) {+ logger?.error(+ c.yellow(+ `${c.yellowBright(' WARNING ')} API server is exposed to network, disabling write and exec operations by default for security reasons. This can cause some APIs to not work as expected. Set \`browser.api.allowExec\` manually to hide this warning. See https://vitest.dev/config/browser/api for more details.`,+ ),+ )+ }+ api.allowWrite ??= parentApi?.allowWrite ?? false+ api.allowExec ??= parentApi?.allowExec ?? false+ }+ else {+ api.allowWrite ??= parentApi?.allowWrite ?? true+ api.allowExec ??= parentApi?.allowExec ?? true+ }+ return api } @@ -838,6 +857,8 @@ export function resolveConfig( resolved.browser.api = resolveApiServerConfig( resolved.browser, defaultBrowserPort,+ resolved.api,+ logger, ) || { port: defaultBrowserPort, }Resolves write and execution flags per API server, defaulting both to disabled for network-exposed peers and enabled on localhost, without extending those restrictions to the browser debugger API.
AI-assisted changepackages/browser/src/node/commands/fs.tssource vitest-dev/vitest@3a30e8712a+8−0
@@ -5,6 +5,12 @@ import { basename, dirname, resolve } from 'node:path' import mime from 'mime/lite' import { isFileServingAllowed } from 'vitest/node' +function assertWrite(path: string, project: TestProject) {+ if (!project.config.browser.api.allowWrite || !project.vitest.config.api.allowWrite) {+ throw new Error(`Cannot modify file "${path}". File writing is disabled because server is exposed to the internet, see https://vitest.dev/config/browser/api.`)+ }Show 21 hidden lines
+}+ function assertFileAccess(path: string, project: TestProject) { if ( !isFileServingAllowed(path, project.vite)@@ -34,6 +40,7 @@ export const writeFile: BrowserCommand< const filepath = resolve(project.config.root, path) assertFileAccess(filepath, project) const dir = dirname(filepath)+ assertWrite(path, project) if (!fs.existsSync(dir)) { await fsp.mkdir(dir, { recursive: true }) }@@ -45,6 +52,7 @@ export const removeFile: BrowserCommand< > = async ({ project }, path) => { const filepath = resolve(project.config.root, path) assertFileAccess(filepath, project)+ assertWrite(path, project) await fsp.rm(filepath) } Adds write guards to the file write and remove commands so direct disk mutation requires the enabled flag, while the debugger route that could achieve equivalent changes remained unchecked.
Security fix
Fixpackages/browser/src/node/rpc.tssource vitest-dev/vitest@385a1aefd4+24−0
@@ -128,6 +128,27 @@ export function setupBrowserRpc(globalServer: ParentBrowserProject, defaultMocke ) } + function isCdpAllowed(project: TestProject) {+ return (+ project.config.api.allowExec+ && project.config.browser.api.allowExecShow 41 hidden lines
+ && project.vitest.config.api.allowExec+ && project.vitest.config.browser.api.allowExec+ && project.config.api.allowWrite+ && project.config.browser.api.allowWrite+ && project.vitest.config.api.allowWrite+ && project.vitest.config.browser.api.allowWrite+ )+ }++ function assertCdpAllowed(project: TestProject) {+ if (!isCdpAllowed(project)) {+ throw new Error(+ `Cannot use CDP because browser API write or exec operations are disabled. See https://vitest.dev/config/browser/api.`,+ )+ }+ }+ function setupClient(project: TestProject, rpcId: string, ws: WebSocket) { const mockResolver = new ServerMockResolver(globalServer.vite, { moduleDirectories: project.config.server?.deps?.moduleDirectories,@@ -271,6 +292,7 @@ export function setupBrowserRpc(globalServer: ParentBrowserProject, defaultMocke provider, contextId: sessionId, sessionId,+ __ensureCDPHandler: () => globalServer.ensureCDPHandler(sessionId, rpcId), }, provider.getCommandsContext(sessionId), ) as any as BrowserCommandContext@@ -344,10 +366,12 @@ export function setupBrowserRpc(globalServer: ParentBrowserProject, defaultMocke // CDP async sendCdpEvent(sessionId: string, event: string, payload?: Record<string, unknown>) {+ assertCdpAllowed(project) const cdp = await globalServer.ensureCDPHandler(sessionId, rpcId) return cdp.send(event, payload) }, async trackCdpEvent(sessionId: string, type: 'on' | 'once' | 'off', event: string, listenerId: string) {+ assertCdpAllowed(project) const cdp = await globalServer.ensureCDPHandler(sessionId, rpcId) cdp[type](event, listenerId) },Rejects debugger event sends and listener registrations unless every write and execution flag across all four API configs is enabled, closing the bypass of restricted operations.
Fixpackages/vitest/src/node/types/browser.tssource vitest-dev/vitest@385a1aefd4+6−0
@@ -245,6 +245,12 @@ export interface BrowserCommandContext { /** @deprecated use `sessionId` instead */ contextId: string sessionId: string+ /**+ * Returns Vitest's cached CDP handler for the current tester RPC connection.+ *+ * @internalShow 5 hidden lines
+ */+ __ensureCDPHandler: () => Promise<any> } export interface BrowserServerStateSession {Declares the internal debugger handler accessor on the command context so server-side implementations reuse the cached connection without exposing a direct browser-side client.
Fixpackages/coverage-v8/src/browser.tssource vitest-dev/vitest@385a1aefd4+8−9
@@ -1,12 +1,15 @@+import type { Profiler } from 'node:inspector' import type { CoverageProviderModule } from 'vitest/node' import type { V8CoverageProvider } from './provider'-import { cdp } from '@vitest/browser/context'Show 32 hidden lines
import { loadProvider } from './load-provider' -const session = cdp() let enabled = false -type ScriptCoverage = Awaited<ReturnType<typeof session.send<'Profiler.takePreciseCoverage'>>>+type ScriptCoverage = Profiler.TakePreciseCoverageReturnType++function triggerCommand(command: string, args: any[] = []): Promise<any> {+ return (globalThis as any).__vitest_browser_runner__.commands.triggerCommand(command, args)+} const mod: CoverageProviderModule = { async startCoverage() {@@ -16,15 +19,11 @@ const mod: CoverageProviderModule = { enabled = true - await session.send('Profiler.enable')- await session.send('Profiler.startPreciseCoverage', {- callCount: true,- detailed: true,- })+ await triggerCommand('__vitest_startV8Coverage') }, async takeCoverage(): Promise<{ result: any[] }> {- const coverage = await session.send('Profiler.takePreciseCoverage')+ const coverage: ScriptCoverage = await triggerCommand('__vitest_takeV8Coverage') const result: typeof coverage.result = [] // Reduce amount of data sent over rpc by doing some early result filteringReplaces the client debugger session used for coverage collection with internal server commands, so profiling no longer depends on the directly exposed browser debugger API.
Patch fingerprints
AI-assisted change 31c3dfceba2499b82e89dccba89309378db4e208efb901919c7230262545b3e5 · Fix 814ac09862ebbdc9b3853b0a3d17cfa07f8710e5b05bf6bed7369544e0dc7674
Advisory references
- https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm
- https://nvd.nist.gov/vuln/detail/CVE-2026-53633
- https://github.com/vitest-dev/vitest/pull/10444
- https://github.com/vitest-dev/vitest/pull/10450
- https://github.com/vitest-dev/vitest/pull/10456
- https://github.com/vitest-dev/vitest/commit/385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7
- https://github.com/vitest-dev/vitest/commit/63e3b2eee4d58da56786a6333f517b9b492528c7
- https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9
- https://github.com/vitest-dev/vitest
- https://github.com/vitest-dev/vitest/releases/tag/v3.2.5
- https://github.com/vitest-dev/vitest/releases/tag/v4.1.8
- https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.4