CVE-2025-68155
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Dec 16, 2025
CISA due date
—
The record
@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoint in `@vitejs/plugin-rsc` allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a `file://` URL in the `filename` query parameter. Version 0.5.8 fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @vitejs/plugin-rsc | 0 | 0.5.8 |
Related vulnerabilities
- GHSA-g239-q96q-x4qm @vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint Same vulnerability
- GHSA-w94c-4vhp-22gx @vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components Also affects @vitejs/plugin-rsc
- GHSA-v457-wxvj-p9w9 @vitejs/plugin-rsc has a Denial of Service with React Server Components Also affects @vitejs/plugin-rsc
- GHSA-c6m7-q6pr-c64r Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components Also affects @vitejs/plugin-rsc
- GHSA-cpqf-f22c-r95x Vite Plugin React has a Denial of Service Vulnerability in React Server Components Also affects @vitejs/plugin-rsc
- CVE-2025-67489 @vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Also affects @vitejs/plugin-rsc
- GHSA-j76j-5p5g-9wfr @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server… Also affects @vitejs/plugin-rsc
- GHSA-fmh4-wr37-44fp React Server Components are Vulnerable to RCE Also affects @vitejs/plugin-rsc