CyberRota Analysis
AI-GeneratedThe vulnerability affects Vitest in Chrome, where the cdp() API improperly exposes raw Chrome DevTools Protocol methods, enabling remote clients to manipulate the configuration file and execute arbitrary Node.js code. This critical flaw (CVSS 9.8) poses significant risks, including unauthorized code execution and potential system compromise. Organizations utilizing affected versions of Vitest should prioritize immediate updates to versions 3.2.5, 4.1.8, or 5.0.0-beta to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.