vitest-dev/vitest · error · Error

Cannot use CDP because browser API write or exec operations

Error message

Cannot use CDP because browser API write or exec operations are disabled. See https://vitest.dev/config/api.

What it means

`assertCdpAllowed` requires `api.allowExec && api.allowWrite` on both the project-level and top-level Vitest config. When Vitest's API is exposed to the network (host set to non-localhost), `allowExec` and `allowWrite` default to false to prevent remote code execution; CDP can execute browser/OS commands, so it's gated behind both flags.

Source

Thrown at packages/browser/src/node/rpc.ts:144

  function canWrite(project: TestProject) {
    return (
      project.config.api.allowWrite
      && project.vitest.config.api.allowWrite
    )
  }

  function isCdpAllowed(project: TestProject) {
    return (
      project.config.api.allowExec
      && project.vitest.config.api.allowExec
      && project.config.api.allowWrite
      && project.vitest.config.api.allowWrite
    )
  }

  function assertCdpAllowed(project: TestProject) {
    if (!isCdpAllowed(project)) {
      throw new Error(
        `Cannot use CDP because browser API write or exec operations are disabled. See https://vitest.dev/config/api.`,
      )
    }
  }

  function setupClient(
    project: TestProject,
    rpcId: string,
    ws: WebSocket,
    options: {
      sessionId: string
    },
  ) {
    const mockResolver = new ServerMockResolver(globalServer.vite, {
      moduleDirectories: project.config?.deps?.moduleDirectories,
    })
    const mocker = project.browser?.provider.mocker

View on GitHub (pinned to d568f8ce37)

Solutions

1. If you trust the network, opt in explicitly: `test: { api: { allowExec: true, allowWrite: true } }` (understand this permits remote code execution).
2. Prefer binding the API to localhost: `test: { api: { host: '127.0.0.1' } }` — defaults then permit CDP.
3. Use Vitest's API token authentication and limit network exposure.

Example fix

// before
export default defineConfig({
  test: { api: { host: '0.0.0.0', port: 9090 } },
})

// after — opt into CDP on a network-exposed server
export default defineConfig({
  test: { api: { host: '0.0.0.0', port: 9090, allowExec: true, allowWrite: true } },
})

function cdpAllowed(project: { config: { api: { allowExec?: boolean; allowWrite?: boolean } } },
                                  vitest: { config: { api: { allowExec?: boolean; allowWrite?: boolean } } }): boolean {
  return !!(
    project.config.api.allowExec && project.config.api.allowWrite
    && vitest.config.api.allowExec && vitest.config.api.allowWrite
  )
}

try {
  await cdp.send('Page.reload')
} catch (err) {
  if (err instanceof Error && /Cannot use CDP/.test(err.message)) {
    // set api.allowExec / api.allowWrite, or bind to localhost
  }
  throw err
}

When it happens

Trigger: Calling `cdp.send` / `cdp.on` (which route to `sendCdpEvent` / `trackCdpEvent` → `assertCdpAllowed`) while the API server is exposed (e.g. `--api.host 0.0.0.0`) and `api.allowExec`/`api.allowWrite` are at their default false.

Common situations: Running Vitest browser mode in a remote/CI dashboard setup with the API on a network interface; shared dev server; containerized Vitest with port forwarded.

Related errors

• Cannot modify file "${path}". File writing is disabled becau
• No codec found for type ${type}
• Unrecognized comparator ${comparator}
• Couldn't write file to fs
• `resolveOptions` has to be used in a test file

AI-assisted analysis of vitest-dev/vitest@d568f8ce37 (2026-08-03). Data as JSON: /data/errors/12250d8cd47e40d8.json. Report an issue: GitHub.