Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact @vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.6. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh Patches Upgrade immediately to @vitejs/plugin-rsc@0.5.26 or later.
Recommended action: Upgrade to 0.5.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact @vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.4. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg Patches Upgrade immediately to @vitejs/plugin-rsc@0.5.23 or later.
Recommended action: Upgrade to 0.5.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The /viterscfindSourceMapURL endpoint in @vitejs/plugin-rsc allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a file:// URL in the filename query parameter. Severity: High Attack Vector: Network Privileges Required: None Scope: Development mode only (vite dev) --- Impact Who Is Affected? - All developers using @vitejs/plugin-rsc during development - Projects running vite dev with the RSC plugin enabled Attack Scenarios 1. Network-Exposed Dev Servers: When developers run vite --host 0.0.0.0 (common for mobile testing), attackers on the same network can read files. 2. ~XSS-Based Attacks:~ ~If the application has an XSS vulnerability, malicious JavaScript can fetch sensitive files and exfiltrate them.~ 3. ~Malicious Dependencies: ~ ~A compromised npm package could include code that reads files during development.~ 4. ~DNS Rebinding:~ (EDIT: This doesn't apply…
Recommended action: Upgrade to 0.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact @vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.3. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-925w-6v3x-g4j4 Patches Upgrade immediately to @vitejs/plugin-rsc@0.5.7 or later.
Recommended action: Upgrade to 0.5.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact @vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.3. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-7gmr-mq3h-m5h9 Patches Upgrade immediately to @vitejs/plugin-rsc@0.5.7 or later.
Recommended action: Upgrade to 0.5.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Arbitrary Remote Code Execution on development server via unsafe dynamic imports in @vitejs/plugin-rsc server function APIs (loadServerAction, decodeReply, decodeAction) when integrated into RSC applications that expose server function endpoints. Impact Attackers with network access to the development server can execute arbitrary JavaScript code with Node.js privileges, allowing them to read/modify files, exfiltrate sensitive data (source code, environment variables, credentials), or pivot to other internal services. While this affects development servers only, the risk increases when using vite --host to expose the server on all network interfaces. Details In the example RSC application provided in Proof of Concept, the server handles server function call through API such as loadServerAction, decodeReply, decodeAction with http request's header and body as inputs:…
Recommended action: Upgrade to 0.5.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained an unauthenticated remote code execution vulnerability in versions prior to 19.0.1, 19.1.2, and 19.2.1. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r Impact Applications using affected versions of @vitejs/plugin-rsc are vulnerable to unauthenticated remote code execution through deserialization of untrusted data. An attacker can execute arbitrary code remotely without authentication, affecting confidentiality, integrity, and availability. Recommendations Upgrade immediately to @vitejs/plugin-rsc@0.5.3 or later. Workarounds Applications not using server-side React or React Server Components are unaffected.
Recommended action: Upgrade to 0.5.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.