Source Code Exposure Vulnerability in @vitejs/plugin-rsc: React Server Components
Summary
GHSA-c6m7-q6pr-c64r: Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components. Affects @vitejs/plugin-rsc versions < 0.5.7. Fixed in 0.5.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @vitejs/plugin-rsc is a Vite plugin that enables the use of React Server Components, allowing developers to build modern web applications with server-rendered components. This plugin enhances performance and user experience by optimizing how React components are rendered on the server. However, it has been found to contain a vulnerability that exposes source code, potentially leading to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability originates from the inclusion of the 'react-server-dom-webpack' package in versions prior to 19.2.3. This flaw allows for source code exposure, which can lead to unauthorized access to application logic and sensitive data. Attackers could exploit this vulnerability to gain insights into the application's internal workings, potentially compromising user data and application integrity.
How To Fix
Minimum fixed version
0.5.7
This is the first release that contains the fix.
npm install @vitejs/plugin-rsc@0.5.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
In summary, the @vitejs/plugin-rsc package has a source code exposure vulnerability due to the inclusion of an affected version of 'react-server-dom-webpack'. It is essential to upgrade to the patched version to secure your application and prevent unauthorized access to sensitive information.
See every vulnerability recorded for @vitejs/plugin-rsc →
FAQ
The vulnerability has a CVSS score of 5.3, indicating a moderate level of risk.
Failing to update could expose your application to unauthorized access, potentially compromising sensitive data and application functionality.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just your package-lock.json file.
Developers should immediately upgrade to @vitejs/plugin-rsc version 0.5.7 or later to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for @vitejs/plugin-rsc.
