Vitest Flaw Rated CVSS 9.4 Hits an npm Package With 65 Million Weekly Downloads
Do Son 
TL;DR
Vitest patched a critical vulnerability rated CVSS 9.4. Browser Mode commands could read, write, or delete files outside the project folder. They did so even when the allowWrite gate was set to false.
Why it matters
Vitest is a testing framework built on Vite. Its npm package draws over 65 million downloads a week, by the project’s own count. That figure counts downloads, not affected users. Only Browser Mode users face this bug. Risk climbs when the Browser Mode API reaches the network. In that setup, allowWrite defaults to false to block file access. This flaw ignored that switch. On a default localhost-only setup with trusted test code, nobody is positioned to abuse it.
How the attack works
Browser Mode offers built-in commands that run on the Node.js side. Several take a file path straight from the browser. However, they skipped the allowWrite check and never confined paths to the project root. So a client reaching the API could touch files anywhere the Vitest process can.
Reads carry the worst impact. Two commands could expose the full contents of any local file. Write and delete commands could create, overwrite, or remove files at any path. Notably, attackers could not choose the file contents, since those commands only produce images or trace archives.
Affected versions
The bug affects Vitest 4.1.9 and below, 3.2.6 and below, and 5.0.0-beta.5 and below. Maintainers fixed it in 4.1.10, 3.2.7, and 5.0.0-beta.6. The Vite+ toolchain also shipped a hotfix bundling the patched build.
Patch and mitigation
First, upgrade through the Vitest releases page today. The fix adds allowWrite checks and confines paths to the project root. Until you patch, keep the Browser Mode API bound to localhost only. Read the full Vitest security advisory for details. No public exploit or in-the-wild abuse has been confirmed. Still, this Vitest vulnerability deserves a quick upgrade.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
