Packages / @vitest/browser / Security

ModerateVulnerabilityGHSA-8gvc-j273-4wm5CVE-2025-24963Published 4 Feb 2025

Vitest browser mode serves arbitrary files

Affected releases · @vitest/browser

  • 3.x3.0.0 – 3.0.3Fixed in 3.0.4
  • 2.x2.0.4 – 2.1.8Fixed in 2.1.9

On 3.x, the newest line:

npm install @vitest/browser@3.0.4
5.x

  1. Not affected

    5.0.0 – 5.0.5

    6 releases, latest

3.x

  1. Affected

    3.0.0 – 3.0.3

    4 releases

  2. Fixed

    3.0.4 – 3.2.7

    19 releases

2.x

  1. Not affected

    2.0.0 – 2.0.3

    4 releases

  2. Affected

    2.0.4 – 2.1.8

    11 releases

  3. Fixed

    2.1.9

    1 release

169 stable releases of @vitest/browser, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @vitest/browser. It is read in your browser and sent nowhere.

What happens

Summary

__screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get the content of arbitrary files.

Details

This __screenshot-error handler on the browser mode HTTP server responds any file on the file system. github.com/vitest-dev/vitest/blob/f17918a79969d…

This code was added by 2d62051.

PoC

  1. Create a directory and change the current directory to that directory

  2. Run npx vitest init browser

  3. Run npm run test:browser

  4. Run curl http://localhost:63315/__screenshot-error?file=/path/to/any/file

Impact

Users explicitly exposing the browser mode server to the network by browser.api.host: true may get any files exposed.