Vitest Browser Mode Reflected XSS and Local RCE via otelCarrier

Vulnerability Overview In Vitest's browser mode, the query parameter under the path is directly inserted into inline module scripts. Because this value is treated as JavaScript source code rather than data, an attacker can construct a browser-side URL to execute arbitrary JavaScript code. Affected Versions Affected versions: - >=4.0.17, =5.0.0-beta.0, <5.0.0-beta.3 Impact description: - The issue affects users who employ Vitest's browser mode. The victim must open or navigate to a carefully crafted Vitest browser runner URL while the Vitest browser server is running. - In the default local browser mode setup, token leakage can be chained to achieve server-side code execution. - The confirmed proof of concept (PoC) uses an authenticated browser API to write the payload into . After Vite/Vitest reloads the configuration, the injected configuration code is executed. Fix Fixed versions: - 4.1.6 - 5.0.0-beta.3 Proof of Concept (PoC) XSS By default, Vitest serves browser-side HTML and a WebSocket API at . Open the following URL: The query value is inserted into the generated inline module script as JavaScript source code: Loading the page triggers the alert, confirming reflected script execution within the browser runner source. RCE via config write A full local RCE PoC can leverage the same injection point to recover , connect to , and call to modify the local . The PoC preserves the original configuration and appends a Node.js payload. When Vitest/Vitest reloads the modified configuration, the payload executes in the Node.js environment. This PoC imports from a CDN to keep the payload compact. Example script and encoded URL

Goal Reached Thanks to every supporter — we hit 100%!

Vitest Browser Mode Reflected XSS and Local RCE via otelCarrier

More from this source