PT-2025-50276 · Vitejs · @Vitejs/Plugin-Rs

Published 2025-12-09 · Updated 2025-12-10 · CVE-2025-67489

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions @vitejs/plugin-rs versions 0.5.5 and below

Description The @vitejs/plugin-rs software, which provides React Server Components (RSC) support for Vite, contains a flaw that could allow for arbitrary remote code execution on the development server. This is due to unsafe dynamic imports within server function APIs – specifically loadServerAction, decodeReply, and decodeAction – when used with RSC applications that expose server function endpoints. An attacker with network access to the development server could potentially read or modify files, steal sensitive data like source code, environment variables, and credentials, or move to other internal services. The risk is heightened when the development server is exposed on all network interfaces using the vite --host command.

Recommendations Update @vitejs/plugin-rs to version 0.5.6 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-67489

GHSA-J76J-5P5G-9WFR

Affected Products

@Vitejs/Plugin-Rs

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67489.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67489 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67489 · Vendor Advisory
• https://github.com/vitejs/vite-plugin-react/commit/fe634b58210d0a4a146a7faae56cd71af3bb9af4 · Note
• https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-j76j-5p5g-9wfr · Note
• https://t.me/CVEtracker/39297 · Telegram Post
• https://twitter.com/CVEnew/status/1998732786795163792 · Twitter Post
• https://twitter.com/0dayPublishing/status/1998500519061393750 · Twitter Post