Description
Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.
CVSS 9.8EPSS 0.5780000000000001%Risque 1.03
Voir la source- Publication
- 2026-07-14 20:17:42
- Versions concernées
- <3.2.5, >=3.0.0,<3.2.5, <4.1.8, >=4.1.8, <5.0.0-beta.4
- Type
- Bibliothèque
- Dernière modification
- 2026-07-29 19:16:47
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H