CVE-2026-73653 is a path traversal vulnerability in Vitest's Browser Mode provider commands (upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, annotateTraces). These commands improperly accept file paths from the browser without enforcing the allowWrite permission or confining file operations to the project root directory. As a result, an attacker who can access the Browser Mode API can perform unauthorized file read, write, and delete operations on the local filesystem accessible to the Vitest process. The vulnerability affects versions prior to 3.2.7, 4.1.10, and 5.0.0-beta.6, where it has been fixed.

An attacker with access to the Browser Mode API can read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process, even if the allowWrite permission is set to false. This can lead to unauthorized data disclosure, data tampering, and potential denial of service by deleting critical files. The CVSS score of 9.4 reflects the critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and low impact on availability.

Upgrade Vitest to version 3.2.7, 4.1.10, or 5.0.0-beta.6 or later, where this vulnerability is fixed. Until upgraded, restrict access to the Browser Mode API to trusted clients only. No official temporary fixes or workarounds are documented; patching is the recommended remediation.