Vitest Browser Mode RCE via CDP Config Override

Vulnerability Overview Vitest Browser Mode exposes a API, which forwards Chrome DevTools Protocol (CDP) methods through the Vitest browser WebSocket RPC. CDP is not subject to restrictions imposed by , , or . Consequently, disabling write and execution operations for Browser Mode does not prevent browser API clients from performing equivalent actions via CDP. In the validated proof-of-concept, the attacker directed the browser's download directory to the project root using and downloaded a controlled via . Vitest then reloaded the modified configuration, executing the attacker-controlled Node.js code. This vulnerability becomes remotely exploitable when the Browser Mode API is also exposed to the network, as the generated browser runner page exposes an API token, active session ID, project name, and project root path. These are required to connect to the browser WebSocket API and select the target download directory. Impact Scope This vulnerability affects Browser Mode projects using CDP-compatible providers (such as Playwright Chromium) when the browser API server is exposed to the network, for example, via . In this mode, Vitest disables write and execution operations by default. However, the generated browser runner page exposes sufficient metadata to allow a remote client to authenticate with the browser WebSocket API via CDP while an active session exists. This metadata includes the browser API token, active session ID, project name, and serialized test configuration containing the project root path. An attacker can invoke Vitest's CDP RPC to override the in the project root using Chrome's download controls. When Vitest reloads the modified configuration, the attacker-controlled Node.js code is executed on the host running Vitest. The same exposed CDP bridge also allows direct execution of browser session JavaScript via . Independent local probes indicate that CDP can navigate to URLs and read rendered file contents, but the primarily validated impact is remote code execution (RCE) resulting from configuration file override. Remediation @vitest/browser (npm): Affected versions are , , and . Patched versions are , , and . Vite-plus (npm): Affected versions are . Patched version is . POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Vitest Browser Mode RCE via CDP Config Override

More from this source