CVE-2026-73653 Vitest: Browser Mode provider commands bypass the file-access permission gate
Attackers can read, create, or delete arbitrary local files via Vitest Browser Mode commands due to missing permission checks and path confinement.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73653?
CVE-2026-73653 is a critical path traversal vulnerability in vitest-dev vitest, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWrite permission gate or confining paths to the project root. A client that can reach the Browser Mode API can read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process even when allowWrite is false. This issue is fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6.
Which versions are affected by CVE-2026-73653?
6 open source packages ship an affected version, including @vitest/browser.
| Package | Affected | Fixed in |
|---|---|---|
@vitest/browser npm | All versions | 3.2.7 |
@vitest/browser npm | All versions | 3.2.7 |
@vitest/browser npm | From 4.0.0 | 4.1.10 |
@vitest/browser npm | From 4.0.0 | 4.1.10 |
@vitest/browser npm | From 5.0.0-beta.1 | 5.0.0-beta.6 |
@vitest/browser npm | From 5.0.0-beta.1 | 5.0.0-beta.6 |
How do I fix CVE-2026-73653?
Upgrade @vitest/browser to a fixed version for your release line: 3.2.7, 4.1.10 or 5.0.0-beta.6.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-73653 being exploited?
There is no known exploitation of CVE-2026-73653 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-UN72189, CLSA-2026-1790162728, CLSA-2026-1792160965, CLSA-2026-1792161476, CLSA-2026-1792161578, CLSA-2026-1792161651 and 12 more.