{"id":"CVE-2026-53633","sourceIdentifier":"security-advisories@github.com","published":"2026-07-14T20:17:42.173","lastModified":"2026-10-24T21:10:00.130","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta."},{"lang":"es","value":"Vitest es un framework de pruebas impulsado por Vite. Desde 3.0.0 hasta 3.2.5, 4.1.8 y 5.0.0-beta.4, el Modo Navegador de Vitest expuso una API cdp() que reenviaba métodos brutos del Protocolo de Herramientas para Desarrolladores de Chrome sin estar restringido por allowWrite o allowExec, permitiendo a un cliente remoto con metadatos de API de navegador expuestos usar CDP Page.setDownloadBehavior y Runtime.evaluate para sobrescribir vite.config.ts y ejecutar código Node.js controlado por el atacante. Este problema está solucionado en las versiones 3.2.5, 4.1.8 y 5.0.0-beta."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vitest-dev","product":"vitest","versions":[{"version":">= 3.0.0, < 3.2.5","status":"affected"},{"version":">= 4.0.0, < 4.1.8","status":"affected"},{"version":">= 5.0.0-beta.0, < 5.0.0-beta.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-16T03:55:26.103276Z","id":"CVE-2026-53633","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-749"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/vitest-dev/vitest/commit/385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/commit/63e3b2eee4d58da56786a6333f517b9b492528c7","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/pull/10444","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/pull/10450","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/pull/10456","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/releases/tag/v3.2.5","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/releases/tag/v4.1.8","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.4","source":"security-advisories@github.com"},{"url":"https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm","source":"security-advisories@github.com"}]}