CVE-2026-53633: Critical RCE in Vitest Browser Mode via Unauthenticated CDP Proxy
Vulnerability Overview
CVE-2026-53633 is a critical remote code execution vulnerability (CVSS 9.8) affecting the @vitest/browser and vite-plus npm packages. The flaw stems from two related weaknesses: CWE-749 (exposed dangerous method) and CWE-862 (missing authorization), which together allow the browser mode API to be reached without any authentication controls.
In practice, Vitest's browser mode exposes a Chrome DevTools Protocol (CDP) proxy endpoint that any network-adjacent or remote attacker can reach. By sending crafted CDP commands through this unauthenticated proxy, an attacker can also overwrite configuration files on the host. The combination of CDP command injection and config overwrite creates a reliable path to arbitrary code execution on the machine running Vitest — typically a developer workstation or CI/CD runner.
Affected Software
The following package versions are confirmed vulnerable:
@vitest/browser>= 3.0.0, <= 3.2.4@vitest/browser>= 4.0.0, <= 4.1.7@vitest/browser>= 5.0.0-beta.0, <= 5.0.0-beta.3vite-plus<= 0.1.23
Both packages are distributed via the npm registry. No patched release has been published at the time of this writing.
Exploitation Status
A public proof-of-concept exploit is available. Disclosed on 15 June 2026, this vulnerability has moved quickly from theoretical to demonstrable — meaning the window between disclosure and active in-the-wild exploitation is narrow. Development environments and CI pipelines that run Vitest browser mode with a network-accessible dev server are the immediate targets. Defenders should treat this as actively exploitable and act accordingly: restrict dev server exposure and apply detections now rather than waiting for patch availability.
How Our Detection Catches It
Our detection coverage ships across seven SIEM platforms: Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL).
The detection logic focuses on three observable signals that distinguish exploitation from normal Vitest usage:
- Unauthenticated CDP endpoint access — HTTP requests hitting the Vitest browser mode CDP proxy path (
/__vitest_browser_api__or equivalent) from sources that have not completed any browser session handshake. - Config file writes following CDP traffic — process or file-write events where a Vitest/Vite worker process writes to
vite.config.*,vitest.config.*, or sibling files shortly after receiving external CDP commands. - Child process spawning from the Vitest process tree — unexpected shell or interpreter processes (e.g.
sh,bash,node -e) spawned as descendants of the Vitest runner, which is a strong post-exploitation signal.
Together these three layers provide both early-stage detection (the unauthorized API call) and post-exploitation detection (process execution), reducing attacker dwell time even if the initial network signal is missed.
Next Steps for Defenders
Until a patch is released, avoid exposing Vitest browser mode dev servers to untrusted networks. Bind the dev server to localhost only, and enforce network-level controls on CI runners. For full query logic, triage guidance, and atomic test cases, see the CVE-2026-53633 detection page on df00tech.