{"action":"Upgrade @vitest/browser to 3.2.7 or later.","affected":[{"fixed":"4.1.10","introduced":"4.0.0"},{"fixed":"3.2.7","introduced":"0"},{"fixed":"5.0.0-beta.6","introduced":"5.0.0-beta.1"}],"component":"@vitest/browser","cve_ids":["CVE-2026-73653"],"ecosystem":"npm","epss":0.0079,"exploited":false,"fixed_versions":["4.1.10","3.2.7","5.0.0-beta.6"],"ghsa_id":"GHSA-p63j-vcc4-9vmv","id":"tcs_01M5KG2P5F6WYNDC2DR9JQ5M0E","modified_at":"2026-09-10T03:51:11.555752293Z","published_at":"2026-07-21T19:36:12Z","references":["https://osv.dev/vulnerability/GHSA-p63j-vcc4-9vmv","https://github.com/vitest-dev/vitest/security/advisories/GHSA-p63j-vcc4-9vmv","https://github.com/vitest-dev/vitest/pull/10674","https://github.com/vitest-dev/vitest/pull/10679","https://github.com/vitest-dev/vitest/pull/10680","https://github.com/vitest-dev/vitest/commit/33f96a145ef09ca6a43b4e555eb273e64a87be23","https://github.com/vitest-dev/vitest/commit/5c18dd267ff7f47f24cab2f615a16b37d90feb7f","https://github.com/vitest-dev/vitest/commit/b795e36b34969bec50b47a9f29d26f799a6a04fb","https://github.com/vitest-dev/vitest","https://github.com/vitest-dev/vitest/releases/tag/v3.2.7","https://github.com/vitest-dev/vitest/releases/tag/v4.1.10","https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.6"],"severity":{"label":"critical","score":9.4},"sources":[{"source":"osv","source_id":"GHSA-p63j-vcc4-9vmv","url":"https://osv.dev/vulnerability/GHSA-p63j-vcc4-9vmv"}],"summary":"@vitest/browser: Browser Mode provider commands bypass the file-access permission gate"}