chore(deps): update dependency @vitest/browser to v3.2.7 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@vitest/browser (source)	3.2.5 → 3.2.7

---

@​vitest/browser: Browser Mode provider commands bypass the file-access permission gate

CVE-2026-73653 / GHSA-p63j-vcc4-9vmv

More information

Details

Summary

Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem (taking screenshots, managing Playwright traces, uploading files for <input type="file">, comparing screenshots).

Several of these commands accept a file path from the browser and act on it without checking the allowWrite permission gate and without confining the path to the project directory. A client that can reach the Browser Mode API can therefore read, create, overwrite, or delete files anywhere the Vitest process can access, even when allowWrite is false.

This matters most when the Browser Mode API is exposed to the network (for example test.api.host is set, or the dev server is reachable from another machine or origin). In that configuration allowWrite defaults to false precisely to block file access, and these commands bypass that protection. On a default localhost-only setup with trusted test code, there is no untrusted party in a position to exploit it. The gap still matters wherever you rely on allowWrite: false to contain untrusted test code, because these commands ignore that flag.

Affected commands and impact

Command	Operation	Impact
upload (Playwright + WebdriverIO)	Read	Arbitrary local file read; contents are loaded into the page and readable by test code. Highest-impact case.
takeScreenshot (Playwright + WebdriverIO)	Write	Writes a PNG to an arbitrary path (absolute path used verbatim), creating parent directories.
screenshotMatcher	Write	Writes reference/diff PNGs; directory derived from client path allows partial traversal.
stopChunkTrace	Write	Writes a Playwright trace .zip to a path escapable via ../ in the trace name.
deleteTracing	Delete	Deletes arbitrary files by path.
annotateTraces	Read (disclosure)	Records a client-controlled attachment path that the reporter copies into the attachments directory, disclosing file contents.

The writes do not let an attacker choose the file contents (they produce PNG images or trace archives), so the integrity impact is creating, overwriting, or deleting a file at an arbitrary path rather than writing a chosen payload. The reads (upload, annotateTraces) are more serious because they expose the full contents of an arbitrary file.

The fix adds, to every file-touching provider command, an allowWrite check for write/delete operations and path confinement to the project root (matching the existing fs command pattern), so client-supplied absolute paths and ../ traversal are rejected.

Severity

• CVSS Score: 9.4 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References

• https://github.com/vitest-dev/vitest/security/advisories/GHSA-p63j-vcc4-9vmv
• https://github.com/vitest-dev/vitest/pull/10674
• https://github.com/vitest-dev/vitest/pull/10679
• https://github.com/vitest-dev/vitest/pull/10680
• https://github.com/vitest-dev/vitest/commit/33f96a145ef09ca6a43b4e555eb273e64a87be23
• https://github.com/vitest-dev/vitest/commit/5c18dd267ff7f47f24cab2f615a16b37d90feb7f
• https://github.com/vitest-dev/vitest/commit/b795e36b34969bec50b47a9f29d26f799a6a04fb
• https://github.com/vitest-dev/vitest/releases/tag/v3.2.7
• https://github.com/vitest-dev/vitest/releases/tag/v4.1.10
• https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.6
• https://github.com/advisories/GHSA-p63j-vcc4-9vmv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vitest-dev/vitest (@​vitest/browser)

v3.2.7

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v3]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10679 (b795e)

    View changes on GitHub

v3.2.6

Compare Source

   🐞 Bug Fixes

• Pin last supported vite-node version  -  by @​sheremet-va (16f12)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mixte	Ready	Preview	Sep 2, 2026 9:20pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
mixte-dev-branch	Ignored		Sep 2, 2026 9:20pm UTC

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.73%. Comparing base (de94618) to head (0a9820f).

Additional details and impacted files

@@           Coverage Diff           @@
##              dev     #293   +/-   ##
=======================================
  Coverage   98.73%   98.73%           
=======================================
  Files          71       71           
  Lines        2370     2370           
  Branches      625      625           
=======================================
  Hits         2340     2340           
  Misses         30       30           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.