Product
A critical vulnerability in `@vitest/browser`'s Browser Mode allows arbitrary file system access due to a bypass of the `allowWrite` permission gate and lack of path confinement, enabling an attacker to read, create, overwrite, or delete files on the local filesystem where the Vitest process is running.