Update dependency @vitest/browser to v4.1.10 [SECURITY] - #6266
Open
renovate[bot] wants to merge 1 commit into
Open
Update dependency @vitest/browser to v4.1.10 [SECURITY]#6266renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Contributor
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.1.8→4.1.10@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
CVE-2026-73653 / GHSA-p63j-vcc4-9vmv
More information
Details
Summary
Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem (taking screenshots, managing Playwright traces, uploading files for
<input type="file">, comparing screenshots).Several of these commands accept a file path from the browser and act on it without checking the
allowWritepermission gate and without confining the path to the project directory. A client that can reach the Browser Mode API can therefore read, create, overwrite, or delete files anywhere the Vitest process can access, even whenallowWriteisfalse.This matters most when the Browser Mode API is exposed to the network (for example
test.api.hostis set, or the dev server is reachable from another machine or origin). In that configurationallowWritedefaults tofalseprecisely to block file access, and these commands bypass that protection. On a default localhost-only setup with trusted test code, there is no untrusted party in a position to exploit it. The gap still matters wherever you rely onallowWrite: falseto contain untrusted test code, because these commands ignore that flag.Affected commands and impact
upload(Playwright + WebdriverIO)takeScreenshot(Playwright + WebdriverIO)screenshotMatcherstopChunkTrace.zipto a path escapable via../in the trace name.deleteTracingannotateTracesThe writes do not let an attacker choose the file contents (they produce PNG images or trace archives), so the integrity impact is creating, overwriting, or deleting a file at an arbitrary path rather than writing a chosen payload. The reads (
upload,annotateTraces) are more serious because they expose the full contents of an arbitrary file.The fix adds, to every file-touching provider command, an
allowWritecheck for write/delete operations and path confinement to the project root (matching the existingfscommand pattern), so client-supplied absolute paths and../traversal are rejected.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
vitest-dev/vitest (@vitest/browser)
v4.1.10Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.1.9Compare Source
🐞 Bug Fixes
importOriginalwith optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)View changes on GitHub
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.