CVE-2026-53633 | Vitest is a testing framework powered by Vite. From 3.0.0 un… | CVSS 9.8 CRITICAL

Description

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.

Metadata

CVE ID: CVE-2026-53633
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-09 20:16 UTC
Published: 2026-07-14 19:35 UTC
Last updated: 2026-07-16 03:55 UTC
Primary CWE: CWE-749
CWE-749: Exposed Dangerous Method or Function
Vendor / Product: vitest-dev / vitest
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
vitest-dev	vitest	—	>= 3.0.0, < 3.2.5, >= 4.0.0, < 4.1.8, >= 5.0.0-beta.0, < 5.0.0-beta.4

Weakness (CWE)

CWE	Source	Description
CWE-749	cna	CWE-749: Exposed Dangerous Method or Function
CWE-862	cna	CWE-862: Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (10)

https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm
https://github.com/vitest-dev/vitest/pull/10444 https://github.com/vitest-dev/vitest/pull/10444
https://github.com/vitest-dev/vitest/pull/10450 https://github.com/vitest-dev/vitest/pull/10450
https://github.com/vitest-dev/vitest/pull/10456 https://github.com/vitest-dev/vitest/pull/10456
https://github.com/vitest-dev/vitest/commit/385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7 https://github.com/vitest-dev/vitest/commit/385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7
https://github.com/vitest-dev/vitest/commit/63e3b2eee4d58da56786a6333f517b9b492528c7 https://github.com/vitest-dev/vitest/commit/63e3b2eee4d58da56786a6333f517b9b492528c7
https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9 https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9
https://github.com/vitest-dev/vitest/releases/tag/v3.2.5 https://github.com/vitest-dev/vitest/releases/tag/v3.2.5
https://github.com/vitest-dev/vitest/releases/tag/v4.1.8 https://github.com/vitest-dev/vitest/releases/tag/v4.1.8
https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.4 https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.4