Summary

__screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get the content of arbitrary files.

Details

This __screenshot-error handler on the browser mode HTTP server responds any file on the file system.
https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130

This code was added by vitest-dev/vitest@2d62051.

PoC

1. Create a directory and change the current directory to that directory
2. Run npx vitest init browser
3. Run npm run test:browser
4. Run curl http://localhost:63315/__screenshot-error?file=/path/to/any/file

Impact

Users explicitly exposing the browser mode server to the network by browser.api.host: true may get any files exposed.

References

• GHSA-8gvc-j273-4wm5
• vitest-dev/vitest@2d62051
• vitest-dev/vitest@ed9aeba