NPM · JULY 2026 · EARLY WARNING

Potential Vulnerability in @vitest/browser npm Package: Early Warning

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
@vitest/browser (npm)
Affected versions
>= 4.0.17, < 4.1.6 or >= 5.0.0-beta.0, < 5.0.0-beta.3 or >= 2.0.4, < 2.1.9 or >= 3.0.0, < 3.0.4 or >= 5.0.0-beta.0, < 5.0.0-beta.4 or >= 4.0.0, < 4.1.8 or >= 3.0.0, < 3.2.5 or >= 4.0.0, < 4.1.10 or < 3.2.7 or >= 5.0.0-beta.1, < 5.0.0-beta.6
Patched version
Not yet available
GHSA-P63J-VCC4-9VMV

An early warning has been issued regarding a potential vulnerability in the @vitest/browser npm package. This vulnerability may allow unauthorized file access when the Browser Mode API is exposed to the network.

What happened

An early warning has been issued for a potential vulnerability in the @vitest/browser npm package. This vulnerability reportedly allows certain commands to bypass file-access permission gates, enabling unauthorized file read, write, and delete operations. This is particularly concerning when the Browser Mode API is exposed to the network. The vulnerability is under investigation and has not been confirmed as exploited in the wild.

The affected versions of @vitest/browser are >= 4.0.17, < 4.1.6 or >= 5.0.0-beta.0, < 5.0.0-beta.3 or >= 2.0.4, < 2.1.9 or >= 3.0.0, < 3.0.4 or >= 5.0.0-beta.0, < 5.0.0-beta.4 or >= 4.0.0, < 4.1.8 or >= 3.0.0, < 3.2.5 or >= 4.0.0, < 4.1.10 or < 3.2.7 or >= 5.0.0-beta.1, < 5.0.0-beta.6. No official fix has been published yet.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If @vitest/browser is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You may be affected if you are using @vitest/browser npm package versions >= 4.0.17, < 4.1.6 or >= 5.0.0-beta.0, < 5.0.0-beta.3 or >= 2.0.4, < 2.1.9 or >= 3.0.0, < 3.0.4 or >= 5.0.0-beta.0, < 5.0.0-beta.4 or >= 4.0.0, < 4.1.8 or >= 3.0.0, < 3.2.5 or >= 4.0.0, < 4.1.10 or < 3.2.7 or >= 5.0.0-beta.1, < 5.0.0-beta.6.

What should I do right now?

Review and restrict access to the Browser Mode API, consider disabling it if not needed, and monitor for any unauthorized file access activities. Consult the primary sources for updates.

Is there an official fix available?

No official fix has been published yet. Monitor the primary sources for updates.

Sources

Join the 0Day waitlist →

← Back to all threats