Technical impact
Vitest is a JavaScript testing framework that provides a Browser Mode enabling debugging through the Chrome DevTools Protocol. In the affected releases, this Browser Mode exposed a cdp() API that forwarded raw CDP methods without gating them by allowWrite or allowExec, letting a remote client with exposed browser API metadata execute CDP commands such as Page.setDownloadBehavior and Runtime.evaluate. This permits overwriting vite.config.ts and executing attacker‑controlled Node.js code, providing full remote code execution on any system running a vulnerable Vitest instance.
Affected Systems
Vitest (vitest‑dev:vitest) versions from 3.0.0 up to but not including 3.2.5, all 4.1.x releases before 4.1.8, and all 5.0.0‑beta.x releases before 5.0.0‑beta.4 are vulnerable. The security fix was added in v3.2.5, v4.1.8, and v5.0.0‑beta.4, and all newer releases are considered safe.
Risk and Exploitability
The CVSS score of 9.8 marks the vulnerability as critical, while the EPSS score of < 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a remote actor that can invoke the exposed browser API; based on the description, it is inferred that the attacker must be able to trigger CDP calls in a client context. Successful exploitation would allow modification of configuration files and execution of attacker‑controlled Node.js code, compromising confidentiality, integrity, and availability of the affected system.
Github GHSA