Update dependency @vitest/browser to v4.1.10 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@vitest/browser (source)	4.1.9 → 4.1.10

---

@​vitest/browser: Browser Mode provider commands bypass the file-access permission gate

GHSA-p63j-vcc4-9vmv

More information

Details

Summary

Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem (taking screenshots, managing Playwright traces, uploading files for <input type="file">, comparing screenshots).

Several of these commands accept a file path from the browser and act on it without checking the allowWrite permission gate and without confining the path to the project directory. A client that can reach the Browser Mode API can therefore read, create, overwrite, or delete files anywhere the Vitest process can access, even when allowWrite is false.

This matters most when the Browser Mode API is exposed to the network (for example test.api.host is set, or the dev server is reachable from another machine or origin). In that configuration allowWrite defaults to false precisely to block file access, and these commands bypass that protection. On a default localhost-only setup with trusted test code, there is no untrusted party in a position to exploit it. The gap still matters wherever you rely on allowWrite: false to contain untrusted test code, because these commands ignore that flag.

Affected commands and impact

Command	Operation	Impact
upload (Playwright + WebdriverIO)	Read	Arbitrary local file read; contents are loaded into the page and readable by test code. Highest-impact case.
takeScreenshot (Playwright + WebdriverIO)	Write	Writes a PNG to an arbitrary path (absolute path used verbatim), creating parent directories.
screenshotMatcher	Write	Writes reference/diff PNGs; directory derived from client path allows partial traversal.
stopChunkTrace	Write	Writes a Playwright trace .zip to a path escapable via ../ in the trace name.
deleteTracing	Delete	Deletes arbitrary files by path.
annotateTraces	Read (disclosure)	Records a client-controlled attachment path that the reporter copies into the attachments directory, disclosing file contents.

The writes do not let an attacker choose the file contents (they produce PNG images or trace archives), so the integrity impact is creating, overwriting, or deleting a file at an arbitrary path rather than writing a chosen payload. The reads (upload, annotateTraces) are more serious because they expose the full contents of an arbitrary file.

The fix adds, to every file-touching provider command, an allowWrite check for write/delete operations and path confinement to the project root (matching the existing fs command pattern), so client-supplied absolute paths and ../ traversal are rejected.

Severity

• CVSS Score: 9.4 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References

• https://github.com/vitest-dev/vitest/security/advisories/GHSA-p63j-vcc4-9vmv
• https://github.com/vitest-dev/vitest/pull/10674
• https://github.com/vitest-dev/vitest/pull/10679
• https://github.com/vitest-dev/vitest/pull/10680
• https://github.com/vitest-dev/vitest/commit/33f96a145ef09ca6a43b4e555eb273e64a87be23
• https://github.com/vitest-dev/vitest/commit/5c18dd267ff7f47f24cab2f615a16b37d90feb7f
• https://github.com/vitest-dev/vitest/commit/b795e36b34969bec50b47a9f29d26f799a6a04fb
• https://github.com/vitest-dev/vitest/releases/tag/v3.2.7
• https://github.com/vitest-dev/vitest/releases/tag/v4.1.10
• https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.6
• https://github.com/advisories/GHSA-p63j-vcc4-9vmv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vitest-dev/vitest (@​vitest/browser)

v4.1.10

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in #​10661 (bae52)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: js/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: js@0.0.0
npm error Found: vitest@4.1.9
npm error node_modules/vitest
npm error   dev vitest@"4.1.9" from the root project
npm error   peer vitest@"4.1.9" from @vitest/browser-playwright@4.1.9
npm error   node_modules/@vitest/browser-playwright
npm error     dev @vitest/browser-playwright@"4.1.9" from the root project
npm error     peerOptional @vitest/browser-playwright@"4.1.9" from vitest@4.1.9
npm error   5 more (@vitest/browser-preview, ...)
npm error
npm error Could not resolve dependency:
npm error peer vitest@"4.1.10" from @vitest/browser@4.1.10
npm error node_modules/@vitest/browser
npm error   dev @vitest/browser@"4.1.10" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-07-24T21_47_04_684Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-07-24T21_47_04_684Z-debug-0.log

[github-actions]

Javascript size report

	Size
Base (main)	1138.9 KB
PR	1143.0 KB
Delta	+4.1 KB (+0.4%)

⚠️ Size increased +0.4% (within 5% threshold).