CVE-2025-68155: @vitejs/plugin-rsc Arbitrary File Read Vulnerability
Summary
CVE-2025-68155: @vitejs/plugin-rsc has an Arbitrary File Read via /__vite_rsc_findSourceMapURL Endpoint. Affects @vitejs/plugin-rsc versions < 0.5.8. Fixed in 0.5.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @vitejs/plugin-rsc is a plugin for Vite, a modern build tool that provides a fast development environment for web applications. This plugin enables developers to utilize React Server Components (RSC) in their projects. While it enhances functionality and developer experience, it also introduces a significant security risk due to an endpoint that allows arbitrary file reads during development mode.
Vulnerability Detail
The vulnerability exists in the /__vite_rsc_findSourceMapURL endpoint of the @vitejs/plugin-rsc, which allows unauthenticated users to read any file accessible to the Node.js process. This occurs when a crafted HTTP request is sent with a file:// URL in the filename query parameter. The lack of proper validation for the requested file path can lead to exposure of sensitive information, including environment files, SSH keys, and other critical data. The vulnerability is particularly dangerous when development servers are exposed to the network, allowing attackers to exploit this flaw easily.
How To Fix
Minimum fixed version
0.5.8
This is the first release that contains the fix.
npm install @vitejs/plugin-rsc@0.5.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid running the Vite development server with the --host 0.0.0.0 option, which exposes it to the network. Instead, use localhost or 127.0.0.1 to limit access to the local machine only.
Conclusion
The CVE-2025-68155 vulnerability in the @vitejs/plugin-rsc poses a significant risk to developers using this plugin in development mode. It is crucial to update to the patched version 0.5.8 to mitigate the risk of arbitrary file reads. Additionally, developers should be cautious about exposing their development servers to the network.
See every vulnerability recorded for @vitejs/plugin-rsc →
FAQ
CVE-2025-68155 is a security vulnerability in the @vitejs/plugin-rsc that allows arbitrary file reads during development mode.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to test your application without needing to sign up.
An attacker can potentially access sensitive files such as environment variables, SSH keys, database passwords, and even source code files.
Yes, the vulnerability has been patched in version 0.5.8 of the @vitejs/plugin-rsc. Updating to this version will resolve the issue.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @vitejs/plugin-rsc.
