Missing Authorization Affecting @vitest/browser package, versions <3.2.7>=4.0.0-beta.1 <4.1.10>=5.0.0-beta.1 <5.0.0-beta.6

@vitest/browser is a Browser running for Vitest

Affected versions of this package are vulnerable to Missing Authorization through the built-in browser commands in @vitest/browser and the browser provider RPC handlers. An attacker can read, create, overwrite, or delete local files by supplying a path to commands such as upload, takeScreenshot, trace handling, and annotation attachment processing. These commands run on the Node.js side of the test runner and accept client-controlled paths without enforcing allowWrite or confining access to the project’s server.fs boundary. In exposed Browser Mode deployments, a remote client can use them to access arbitrary files the Vitest process can reach, exposing file contents or corrupting and removing files outside the intended project area.

Notes

• The bypass is only relevant when Browser Mode is reachable by an untrusted client, and you depend on browser.api.allowWrite: false or server.fs confinement; on the default localhost-only setup with trusted test code, the advisory’s risk does not materialize.
• The highest-impact path is file upload: a browser-side upload can load arbitrary local file contents back into the page, so the exposure is not limited to write/delete operations.

Workarounds

• If you rely on Browser Mode’s file-access restrictions, set server.fs.deny to cover sensitive files or paths so built-in commands like upload and takeScreenshot cannot read or write them.
• Keep Browser Mode API writing disabled by setting test.browser.api.allowWrite: false and test.api.allowWrite: false when the Browser Mode API is exposed to untrusted clients, which blocks file-creation, overwrite, and delete operations through provider commands.

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub PR
• Maintainer's Advisory