GHSA-j76j-5p5g-9wfr
Critical · 9.8CVSS
9.8
EPSS
—
Published
Dec 8, 2025
CISA due date
—
The record
@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @vitejs/plugin-rsc | 0 | 0.5.6 |
Related vulnerabilities
- CVE-2025-67489 @vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Same vulnerability
- GHSA-w94c-4vhp-22gx @vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components Also affects @vitejs/plugin-rsc
- GHSA-v457-wxvj-p9w9 @vitejs/plugin-rsc has a Denial of Service with React Server Components Also affects @vitejs/plugin-rsc
- GHSA-g239-q96q-x4qm @vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint Also affects @vitejs/plugin-rsc
- CVE-2025-68155 @vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Also affects @vitejs/plugin-rsc
- GHSA-c6m7-q6pr-c64r Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components Also affects @vitejs/plugin-rsc
- GHSA-cpqf-f22c-r95x Vite Plugin React has a Denial of Service Vulnerability in React Server Components Also affects @vitejs/plugin-rsc
- GHSA-fmh4-wr37-44fp React Server Components are Vulnerable to RCE Also affects @vitejs/plugin-rsc