CVE-2026-53633

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53633
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53633.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53633
Aliases
Downstream
Published
2026-07-14T19:35:42.739Z
Modified
2026-07-17T03:41:41.140612569Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Details

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53633.json",
    "cwe_ids": [
        "CWE-749",
        "CWE-862"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/vitest-dev/vitest

Affected ranges

Type
GIT
Repo
https://github.com/vitest-dev/vitest
Events
Introduced
01600e04c2252abee78fc8a695197ce62f2846d4
Introduced
da7ce1712fd4d0e4e807ec01ce755581e6892d5b
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2cbad0a923c48c6144266df3cd25f93547cb5221
Fixed
e61f2dd2a0ba0a266c1c5e0334aad3799fee527f
Fixed
90569f5b6ac33d0a5602672e8cfb8dc9fcdb99b3
Fixed
385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7
Fixed
63e3b2eee4d58da56786a6333f517b9b492528c7
Fixed
e4067b3b150005fd42cf75f994300119245806b9
Database specific 
{
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.2.5"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.1.8"
        },
        {
            "introduced": "5.0.0-beta.0"
        },
        {
            "fixed": "5.0.0-beta.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9
v3.1.0
v3.1.0-beta.1
v3.1.0-beta.2
v3.1.1
v3.1.2
v3.1.3
v3.2.0
v3.2.0-beta.1
v3.2.0-beta.2
v3.2.0-beta.3
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v4.*
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.14
v4.0.15
v4.0.16
v4.0.17
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v4.1.0
v4.1.0-beta.1
v4.1.0-beta.2
v4.1.0-beta.3
v4.1.0-beta.4
v4.1.0-beta.5
v4.1.0-beta.6
v4.1.1
v4.1.2
v4.1.3
v4.1.4
v4.1.5
v4.1.6
v4.1.7
v5.*
v5.0.0-beta.1
v5.0.0-beta.2
v5.0.0-beta.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53633.json"