GHSA-p63j-vcc4-9vmv: @vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem (taking screenshots, managing Playwright traces, uploading files for <input type="file">, comparing screenshots). Several of these commands accept a file path from the browser and act on it without checking the allowWrite permission gate and without confining the path to the project directory. A client that can reach the Browser Mode API can therefore read, create, overwrite, or delete files anywhere the Vitest process can access, even when allowWrite is false. This matters most when the Browser Mode API is exposed to the network (for example test.api.host is set, or the dev server is reachable from another machine or origin). In that configuration allowWrite defaults to false precisely to block file access, and these commands bypass that protection. On a default localhost-only setup with trusted test code, there is no untrusted party in a position to exploit it. The gap still matters wherever you rely on allowWrite: false to contain untrusted test code, because these commands ignore that flag. Affected commands and impact | Command | Operation | Impact | |---|---|---| | upload (Playwright + WebdriverIO) | Read | Arbitrary local file read; contents are loaded into the page and readable by test code. Highest-impact case. | | takeScreenshot (Playwright + WebdriverIO) | Write | Writes a PNG to an arbitrary path (absolute path used verbatim), creating parent directories. | | screenshotMatcher | Write | Writes reference/diff PNGs; directory derived from client path allows partial traversal. | | stopChunkTrace | Write | Writes a Playwright trace .zip to a path escapable via ../ in the trace name. | | deleteTracing | Delete | Deletes arbitrary files by path. | | annotateTraces | Read (disclosure) | Records a client-controlled attachment path that the reporter copies into the attachments directory, disclosing file contents. | The