PT-2025-51776 · Vitejs · @Vitejs/Plugin-Rs

Published 2025-12-16 · Updated 2025-12-17 · CVE-2025-68155

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions @vitejs/plugin-rs versions prior to 0.5.8

Description The @vitejs/plugin-rs software, which provides React Server Components (RSC) support for Vite, has an issue where the / vite rsc findSourceMapURL API endpoint allows unauthenticated arbitrary file read during development mode. An attacker can potentially read any file accessible to the Node.js process by sending a specially crafted HTTP request. The request includes a file:// URL within the filename query parameter.

Recommendations Update to version 0.5.8 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2025-68155

GHSA-G239-Q96Q-X4QM

Affected Products

@Vitejs/Plugin-Rs

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68155.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-68155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68155 · Security Note
• https://github.com/facebook/react/pull/30741 · Note
• https://github.com/facebook/react/pull/29708 · Note
• https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-g239-q96q-x4qm · Note
• https://github.com/vitejs/vite-plugin-react/commit/582fba0b9a52b13fcff6beaaa3bfbd532bc5359d · Note
• https://twitter.com/CVEnew/status/2001350869854621974 · Twitter Post
• https://t.me/CVEtracker/40000 · Telegram Post