CVE-2025-68155

Name of the Vulnerable Software and Affected Versions @vitejs/plugin-rs versions prior to 0.5.8

Description The @vitejs/plugin-rs software, which provides React Server Components (RSC) support for Vite, has an issue where the / vite rsc findSourceMapURL API endpoint allows unauthenticated arbitrary file read during development mode. An attacker can potentially read any file accessible to the Node.js process by sending a specially crafted HTTP request. The request includes a file:// URL within the filename query parameter.

Recommendations Update to version 0.5.8 or later.