Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@rsdoctor/rspack-plugin

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

    CVE-2026-61782 · GHSA-jmg2-rcxh-w8q3

    Affected
    • npm @rsdoctor/rspack-plugin <= 1.5.15
    Fixed in
    1.5.16· Vendor fix available
    Issue
    The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces (0.0.0.0) and serves a POST /api/data/key endpoint with no authentication and wildcard CORS (Access-Control-Allow-Origin: ). Any network-adjacent or remote attacker can send a single unauthenticated request to retrieve the full source code of all compiled JavaScript modules (moduleCodeMap), serialized build configuration (configs), error details, and other sensitive build metadata. This server is enabled by default in non-CI environments, requiring no special configuration from the victim developer. Details Root cause: server binds to all interfaces with no authentication and no key allowlist. The vulnerability is composed of four independently observable defects that together create a complete unauthenticated information-disclosure path: 1. Server binds to 0.0.0.0 (all interfaces) packages/utils/src/build/server.ts:107 calls server.listen(port, callback) without a host…

    Recommended action: Upgrade to 1.5.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →