CVE-2025-67489 Details
Description
@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction) when integrated into RSC applications that expose server function endpoints. Attackers with network access to the development server can read/modify files, exfiltrate sensitive data (source code, environment variables, credentials), or pivot to other internal services. While this affects development servers only, the risk increases when using vite --host to expose the server on all network interfaces. This issue is fixed in version 0.5.6.
A remote code execution vulnerability has been identified in @vitejs/plugin-rsc, which provides support for React Server Components (RSC) in Vite. This vulnerability affects versions 0.5.5 and prior, allowing arbitrary code execution on the development server. The issue arises from unsafe dynamic imports in server function APIs, such as loadServerAction, decodeReply, and decodeAction, when used in RSC applications that expose server function endpoints. Attackers with network access to the development server can exploit this vulnerability to execute arbitrary JavaScript code with Node.js privileges. This could lead to unauthorized access or modification of files, exfiltration of sensitive data like source code, environment variables, and credentials, or pivoting to other internal services. The vulnerability is particularly concerning when the development server is exposed on all network interfaces using 'vite --host'.
Users can upgrade to @vitejs/plugin-rsc version 0.5.6 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 9, 2025CISA-ADP
Assessed Dec 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vitejs/vite-plugin-react/commit/fe634b58210d0a4a146a7faae56cd71af3bb9af4 | [email protected] | Source CodeVendor |
| https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-j76j-5p5g-9wfr | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| @vitejs/plugin-rsc | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 9, 2025 | New CVE Received | [email protected] |