Critical RCE Vulnerability in @vitejs/plugin-rsc: Unauthenticated Remote Code Execution Risk
Summary
GHSA-fmh4-wr37-44fp: React Server Components are Vulnerable to RCE. Affects @vitejs/plugin-rsc versions < 0.5.3. Fixed in 0.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @vitejs/plugin-rsc package is a plugin for Vite that enables the use of React Server Components. It allows developers to build applications that can render components on the server, improving performance and user experience. However, this package has been found to contain a critical vulnerability that exposes applications to remote code execution risks.
Vulnerability Detail
The vulnerability originates from the inclusion of the react-server-dom-webpack library within the @vitejs/plugin-rsc package. Versions prior to 19.0.1, 19.1.2, and 19.2.1 of this library contain an unauthenticated remote code execution flaw due to improper deserialization of untrusted data. An attacker can exploit this vulnerability to execute arbitrary code on the server without any authentication, jeopardizing the confidentiality, integrity, and availability of the affected applications.
How To Fix
Minimum fixed version
0.5.3
This is the first release that contains the fix.
npm install @vitejs/plugin-rsc@0.5.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If your application does not utilize server-side React or React Server Components, it remains unaffected by this vulnerability. Therefore, no immediate action is required for those applications.
Conclusion
In summary, the @vitejs/plugin-rsc package has a critical vulnerability that can lead to unauthenticated remote code execution. It is essential for developers using this package to upgrade to version 0.5.3 or later to safeguard their applications. For those not using server-side React, no immediate action is necessary.
See every vulnerability recorded for @vitejs/plugin-rsc →
FAQ
The vulnerability is an unauthenticated remote code execution flaw that allows attackers to execute arbitrary code on the server.
Versions of @vitejs/plugin-rsc prior to 0.5.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized access to sensitive data, disruption of services, and complete control over the affected server.
If your application does not use server-side React or React Server Components, it is not affected. Otherwise, upgrading is the recommended approach.
References
Related vulnerabilities
Recent vulnerabilities recorded for @vitejs/plugin-rsc.
