Vitest Browser Mode API Exposure: Potential RCE Vulnerability
- Severity
- HIGH
- Affected component
- @vitest/browser (npm)
- Affected versions
- >= 4.0.17, < 4.1.6 or >= 5.0.0-beta.0, < 5.0.0-beta.3 or >= 2.0.4, < 2.1.9 or >= 3.0.0, < 3.0.4 or >= 5.0.0-beta.0, < 5.0.0-beta.4 or >= 4.0.0, < 4.1.8 or >= 3.0.0, < 3.2.5 or >= 4.0.0, < 4.1.10 or < 3.2.7 or >= 5.0.0-beta.1, < 5.0.0-beta.6
- Patched version
- Not yet available
An early warning has been issued regarding a potential remote code execution vulnerability in the Vitest Browser Mode API. This vulnerability affects specific versions of @vitest/browser and vite-plus npm packages.
What happened
An early warning has been issued for a potential remote code execution vulnerability in the Vitest Browser Mode API. This vulnerability arises from the exposure of the `cdp()` API, which forwards raw Chrome DevTools Protocol (CDP) methods over the Vitest browser WebSocket RPC. This could lead to remote code execution in Browser Mode projects using a CDP-capable provider, such as Playwright Chromium, when the browser API server is exposed to the network.
The affected versions of the @vitest/browser npm package are >= 4.0.17, < 4.1.6 or >= 5.0.0-beta.0, < 5.0.0-beta.3 or >= 2.0.4, < 2.1.9 or >= 3.0.0, < 3.0.4 or >= 5.0.0-beta.0, < 5.0.0-beta.4 or >= 4.0.0, < 4.1.8 or >= 3.0.0, < 3.2.5 or >= 4.0.0, < 4.1.10 or < 3.2.7 or >= 5.0.0-beta.1, < 5.0.0-beta.6. The affected versions of the vite-plus npm package are < 0.1.17 or < 0.1.24 or < 0.1.24 or < 0.1.24.
What to do about it
- Avoid exposing the Browser Mode API to the network.
- If exposure is necessary, ensure that write and exec operations are properly disabled and monitored.
- Consult the primary sources for the most current information and updates on this vulnerability.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
@vitest/browser is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using the @vitest/browser npm package in the affected version ranges or the vite-plus npm package in the affected version ranges.
What should I do right now?
Avoid exposing the Browser Mode API to the network. If exposure is necessary, ensure that write and exec operations are properly disabled and monitored. Consult the primary sources for the most current information and updates on this vulnerability.
Is there an official fix available?
No official fix has been published yet. Monitor the sources below for updates.