Vitest on Mythryl: “We've published a Browser Mode security advisory. CDP-capable…”

We've published a Browser Mode security advisory. CDP-capable providers like Playwright Chromium with the browser API exposed to the network allowed attackers to run code on the host. Update vitest/browser to 5.0.0-beta.4, 4.1.8, or 3.2.6. Vite+ users: Upgrade to 0.1.24 github.com/vitest-dev/v...

github.comExposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE## Summary Vitest Browser Mode exposes a `cdp()` API that forwards raw Chrome DevTools Protocol (CDP) methods over the Vitest browser WebSocket RPC. CDP is not gated by `browser.api.allowWrite`,...

1/6/26, 5:47 pm6 reposts26 likes

Post