CVE-2026-53633: 
JavaScript vulnerability analysis and mitigation

CVE-2026-53633 is a critical remote code execution (RCE) vulnerability in Vitest's Browser Mode that allows unauthenticated remote attackers to execute arbitrary Node.js code on the host running Vitest. The flaw exists in the cdp() API, which forwards raw Chrome DevTools Protocol (CDP) methods without enforcing allowWrite or allowExec permission gates. Affected versions include @vitest/browser 3.0.0–3.2.4, 4.0.0–4.1.7, and 5.0.0-beta.0–5.0.0-beta.3, as well as vite-plus ≤0.1.23. The advisory was published on June 15, 2026, with NVD publication on July 14, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory).

The root cause is a missing authorization check (CWE-862) on an exposed dangerous method (CWE-749): Vitest's Browser Mode WebSocket RPC exposed sendCdpEvent and trackCdpEvent handlers that proxied arbitrary CDP commands directly to the browser without checking whether allowWrite or allowExec permissions were enabled. When the browser API server is bound to all interfaces (e.g., --browser.api.host=0.0.0.0), the generated browser runner HTML page at /__vitest_test__/ leaks the API token, active session ID, project name, and project root path — all the metadata needed to authenticate to the WebSocket API. An attacker can then call Page.setDownloadBehavior to redirect browser downloads to the project root and Runtime.evaluate to trigger a download of a malicious vite.config.ts, which Vitest automatically reloads, executing attacker-controlled Node.js code (CWE-94). The fix, introduced in PR #10444 and backported in #10450 and #10456, adds an isCdpAllowed() guard that requires both allowWrite and allowExec to be enabled before any CDP RPC call is processed (GitHub Advisory, Fix PR #10444).

Successful exploitation results in full compromise of the host running Vitest: an attacker achieves arbitrary Node.js code execution with the privileges of the Vitest process, enabling complete confidentiality loss (access to source code, secrets, environment variables), integrity loss (overwriting project files), and availability impact (disruption of the development or CI environment). The attack is unauthenticated and requires no user interaction, making it automatable and particularly dangerous in CI/CD pipelines or shared development environments where the browser API server is exposed to the network (GitHub Advisory).

1. Reconnaissance: Identify Vitest Browser Mode instances exposed to the network (e.g., via Shodan or Censys) by scanning for the default port (e.g., 63315) and checking for the presence of /__vitest_test__/ — the browser runner HTML page served by Vitest.
2. Extract metadata: Fetch http://<target>:<port>/__vitest_test__/ and parse the embedded JavaScript globals to extract: window.VITEST_API_TOKEN, __vitest_browser_runner__.sessionId, __vitest_browser_runner__.config.name, and __vitest_browser_runner__.config.root.
3. Connect to WebSocket API: Establish a WebSocket connection to /__vitest_browser_api__?type=tester&rpcId=<rpcId>&sessionId=<sessionId>&projectName=<name>&method=none&token=<token> using the extracted credentials.
4. Set download directory via CDP: Call the sendCdpEvent RPC method with Page.setDownloadBehavior payload: { behavior: "allow", downloadPath: <project_root> } to redirect browser downloads to the Vitest project root.
5. Overwrite vite.config.ts: Call sendCdpEvent again with Runtime.evaluate, injecting JavaScript that creates a Blob containing a malicious vite.config.ts (e.g., with a child_process.exec reverse shell payload) and triggers a download via a synthetic anchor click, overwriting the legitimate config file.
6. Trigger RCE: Vitest's file watcher detects the changed vite.config.ts and automatically reloads it, executing the attacker-controlled Node.js payload on the host (GitHub Advisory).

• Network: Unexpected HTTP GET requests to /__vitest_test__/ from external IP addresses; WebSocket connections to /__vitest_browser_api__ from non-localhost sources; outbound connections from the Vitest host to unknown IPs following a config reload.
• File System: Unexpected modification timestamp on vite.config.ts in the project root; presence of unfamiliar or obfuscated content in vite.config.ts (e.g., require('child_process') or base64-encoded payloads); new files downloaded to the project root directory.
• Logs: Vitest server logs showing WebSocket connections from external IPs; log entries for sendCdpEvent calls with Page.setDownloadBehavior or Runtime.evaluate; Vitest config reload events (vite.config.ts changed, restarting...) not triggered by a developer.
• Process: Unexpected child processes spawned by the Vitest/Node.js process (e.g., sh, bash, curl, wget, python) following a config reload (GitHub Advisory).

Upgrade to the patched versions: 3.2.5, 4.1.8, or 5.0.0-beta.4 for @vitest/browser; and 0.1.24 for vite-plus. The fix gates all CDP RPC calls (sendCdpEvent, trackCdpEvent) behind a check requiring both allowWrite and allowExec to be enabled. As an immediate workaround for those unable to upgrade, avoid exposing the Vitest browser API server to the network — do not set browser.api.host to 0.0.0.0 or any non-loopback address. If network exposure is required, restrict access via firewall rules to trusted IP ranges only (GitHub Advisory, Fix PR #10444).

The vulnerability was reported and fixed by Vitest maintainer sheremet-va and contributor hi-ogawa, with the advisory published on June 15, 2026. Security news outlet SecurityOnline.info covered the vulnerability shortly after disclosure. Red Hat tracked the issue via Bugzilla (bug 2500586) and published a CVE advisory. Qualys added detection (ID 5013807) and Tenable added cloud and container security plugins (443246). The fix was rapidly backported to all supported major versions (v3, v4, v5-beta) within the same day (GitHub Advisory, SecurityOnline, Red Hat).