{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53633", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-09T20:16:59.647Z", "datePublished": "2026-07-14T19:35:42.739Z", "dateUpdated": "2026-07-14T19:35:42.739Z"}, "containers": {"cna": {"title": "Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE", "problemTypes": [{"descriptions": [{"cweId": "CWE-749", "lang": "en", "description": "CWE-749: Exposed Dangerous Method or Function", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm"}, {"name": "https://github.com/vitest-dev/vitest/pull/10444", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/pull/10444"}, {"name": "https://github.com/vitest-dev/vitest/pull/10450", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/pull/10450"}, {"name": "https://github.com/vitest-dev/vitest/pull/10456", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/pull/10456"}, {"name": "https://github.com/vitest-dev/vitest/commit/385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/commit/385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7"}, {"name": "https://github.com/vitest-dev/vitest/commit/63e3b2eee4d58da56786a6333f517b9b492528c7", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/commit/63e3b2eee4d58da56786a6333f517b9b492528c7"}, {"name": "https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9"}, {"name": "https://github.com/vitest-dev/vitest/releases/tag/v3.2.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/releases/tag/v3.2.5"}, {"name": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.8"}, {"name": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.4"}], "affected": [{"vendor": "vitest-dev", "product": "vitest", "versions": [{"version": ">= 3.0.0, < 3.2.5", "status": "affected"}, {"version": ">= 4.0.0, < 4.1.8", "status": "affected"}, {"version": ">= 5.0.0-beta.0, < 5.0.0-beta.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T19:35:42.739Z"}, "descriptions": [{"lang": "en", "value": "Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta."}], "source": {"advisory": "GHSA-g8mr-85jm-7xhm", "discovery": "UNKNOWN"}}}}

{}

{}

{}

{}