CRITICAL9.6npm
GHSA-2h32-95rg-cppp· CVE-2026-47428Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
Modified: 9/10/2026
package
npm/@vitest/browser
pkg:npm/%40vitest/browser
MEDIUM5.9npm
GHSA-8gvc-j273-4wm5· CVE-2025-24963Vitest browser mode serves arbitrary files
Modified: 2/4/2025
CRITICAL9.8npm
GHSA-g8mr-85jm-7xhm· CVE-2026-53633Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Modified: 8/13/2026
CRITICAL9.4npm
GHSA-p63j-vcc4-9vmv· CVE-2026-73653@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
Modified: 9/10/2026