@vitest/browser vulnerabilities
Browser running for Vitest
- Registry
- npm
- Latest
- 5.0.5
- License
- MIT
5 known advisories
The latest version, 5.0.5, is not affected by any of them. Projects on older versions may be.
npm install @vitest/browser@5.0.5Security advisories for @vitest/browser
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
- Affected
- >=5.0.0-beta.6 <5.0.5
- Fixed in
- 5.0.5
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
- Affected
- >=4.0.0 <4.1.10 · <3.2.7 · >=5.0.0-beta.1 <5.0.0-beta.6
- Fixed in
- 3.2.7, 4.1.10, 5.0.0-beta.6
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
- Affected
- >=5.0.0-beta.0 <5.0.0-beta.4 · >=4.0.0 <4.1.8 · >=3.0.0 <3.2.5
- Fixed in
- 3.2.5, 4.1.8, 5.0.0-beta.4
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
- Affected
- >=4.0.17 <4.1.6 · >=5.0.0-beta.0 <5.0.0-beta.3
- Fixed in
- 4.1.6, 5.0.0-beta.3
Vitest browser mode serves arbitrary files
- Affected
- >=2.0.4 <2.1.9 · >=3.0.0 <3.0.4
- Fixed in
- 2.1.9, 3.0.4
Which of your client projects still run an old @vitest/browser?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.