@vitest/browser npm Package Vulnerability: Early Warning
An early warning has been issued regarding a vulnerability in the @vitest/browser npm package, which reportedly allows certain commands to bypass file-access permission gates, enabling arbitrary file operations. This issue is under investigation and affects specific versions of the package.
What happened
The @vitest/browser npm package is under investigation for a vulnerability that appears to allow certain Browser Mode provider commands to bypass file-access permission gates. This vulnerability could enable arbitrary file read, write, and delete operations, particularly when the Browser Mode API is exposed to the network. The affected versions include multiple ranges such as from 4.0.17 to 4.1.6, 5.0.0-beta.0 to 5.0.0-beta.3, and others as detailed in the advisory.
Professional software engineers are advised to review their use of the @vitest/browser package and assess whether the Browser Mode API is exposed to the network. If so, it is recommended to restrict network exposure of this API using firewalls or other network controls to limit access. The vulnerability has been tracked under GHSA-P63J-VCC4-9VMV and more details can be found in the GitHub Advisory Database.
It is important to note that this is an early warning and the compromise is not yet confirmed. Further information should be obtained from the primary sources to fully understand the implications and necessary mitigations.
How 0Day mitigates this
@vitest/browser is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.