vitejs vite-plugin-react vulnerabilities (CVE)

CVE records published for vitejs vite-plugin-react, newest first. Follow to get an email when a new one appears.

2 results

7.5High

CVE-2025-68155 10 months ago

@vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development

vitejs vite-plugin-react

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoint in `@vitejs/plugin-rsc` allows unauthenticated arbitrary file read during development mode. An attacker can read any…

9.8Critical

CVE-2025-67489 11 months ago

@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server

vitejs vite-plugin-react

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeRep…