MediumGHSA-8gvc-j273-4wm5CVE-2025-24963

Vitest browser mode serves arbitrary files

Published 4 Feb 2025 · Updated 4 Feb 2025

Affected packages

@vitest/browsernpm
Affected
>=2.0.4 <2.1.9
Fixed in
2.1.9
Update to the fixed version for your release line, for example:npm install @vitest/browser@2.1.9
@vitest/browsernpm
Affected
>=3.0.0 <3.0.4
Fixed in
3.0.4
Update to the fixed version for your release line, for example:npm install @vitest/browser@3.0.4

Details

Summary

__screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.

Details

This __screenshot-error handler on the browser mode HTTP server responds any file on the file system. https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130

This code was added by https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f.

PoC

1. Create a directory and change the current directory to that directory 1. Run npx vitest init browser 1. Run npm run test:browser 2. Run curl http://localhost:63315/__screenshot-error?file=/path/to/any/file

Impact

Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed.

Is GHSA-8gvc-j273-4wm5 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected @vitest/browser, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.