Directory Traversal Vulnerability in Vitest Testing Framework by Vitest Dev
CVE-2026-73653
9.4CRITICAL
What is CVE-2026-73653?
The Vitest testing framework has a directory traversal vulnerability that allows unauthorized access to local file systems. In versions before 3.2.7, 4.1.10, and 5.0.0-beta.6, commands within the Browser Mode provider, such as upload, takeScreenshot, and deleteTracing, do not properly enforce the allowWrite permission. This failure permits attackers to access arbitrary local files, potentially allowing them to read sensitive data, overwrite existing files, or delete files on the system, irrespective of whether the allowWrite permission is set to false.
Affected Version(s)
vitest < 3.2.7 < 3.2.7
vitest >= 4.0.0, < 4.1.10 < 4.0.0, 4.1.10
vitest >= 5.0.0-beta.1, < 5.0.0-beta.6 < 5.0.0-beta.1, 5.0.0-beta.6