SecurityOnlineDo Son
Vitest RCE Vulnerability (CVSS 9.8): Public PoC Disclosed for Testing Tool With 57M Weekly Downloads (CVE-2026-53633)
Part of the CVE-2026-53633 story · since 16 Jun
- Tue 16 Jun, 03:47 UTC. SecurityOnline, first report. Vitest RCE Vulnerability (CVSS 9.8): Public PoC Disclosed for Testing Tool With 57M Weekly Downloads (CVE-2026-53633). This article, 1st of 1.
The article discusses a critical remote code execution (RCE) vulnerability in the Vitest testing framework, tracked as CVE-2026-53633, with a CVSS score of 9.8. The vulnerability arises from the Browser Mode's cdp() API, which allows attackers to bypass write and exec protections and overwrite configuration files. If exposed to the network, this can lead to unauthorized access and execution of malicious code. The flaw particularly affects projects using CDP-capable providers.
Developers are advised to upgrade to the latest versions (v4.1.8 for 4.x and v3.2.5 for 3.x) and to avoid exposing Browser Mode to untrusted networks until patched.
How the story developed
1 article from 1 outlet since 16 Jun. Quiet since 16 Jun. This was the first report.
- Tue 16 Jun, 03:47 UTC. SecurityOnline, first report. Vitest RCE Vulnerability (CVSS 9.8): Public PoC Disclosed for Testing Tool With 57M Weekly Downloads (CVE-2026-53633). This article, 1st of 1.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 1 articles as a listHide the list
- Tue 16 JunDay 01
- Vitest RCE Vulnerability (CVSS 9.8): Public PoC Disclosed for Testing Tool With 57M Weekly Downloads (CVE-2026-53633)03:47 · SecurityOnline · First report · This article, 1st of 1