@vitest/browser
npm5 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @vitest/browserpage 1 of 1
- CVE-2025-24963MEDIUMCVSS 5.9EG 5.9fixed in 2.1.9 or 3.0.4, by version range2025-02-04
Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an a…
- CVE-2026-112948MEDIUMCVSS 6.5EG 6.5fixed in 5.0.52026-10-20
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles …
- CVE-2026-47428CRITICALCVSS 9.6EG 9.6fixed in 4.1.6 or 5.0.0-beta.3, by version range2026-06-01
Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted b…
- CVE-2026-53633CRITICALCVSS 9.8EG 9.8fixed in 5.0.0-beta.4, 4.1.8 or 3.2.5, by version range2026-06-15
Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, all…
- CVE-2026-73653CRITICALCVSS 9.4EG 9.4fixed in 4.1.10, 3.2.7 or 5.0.0-beta.6, by version range2026-08-13
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept …
Check whether @vitest/browser is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @vitest/browser CVEs against the assets you own.
Book a Demo →