Do Son A Vitest vulnerability rated CVSS 9.4 lets Browser Mode commands bypass the file-access gate. The npm package sees 65M weekly downloads.
Vitest
A critical Vitest RCE vulnerability (CVE-2026-53633, CVSS 9.8) has public PoC code. Browser Mode flaw enables config overwrite and remote code execution.
Critical 9.8 CVSS flaws trigger Vitest remote code execution risks. Discover how to protect your testing environments and patch these bugs immediately.