CVE-2025-68155: Vite @vitejs/plugin-rsc arbitrary file read in /__vite_rsc_findSourceMapURL

CVE-2025-68155 · Severity: low · CVSS 3.1 · Published 2025-12-16

@vitejs/plugin-rsc is a React plugin for the Vite build tool used in web development. During development mode, an unauthenticated attacker can read any file accessible to the Node.js process by exploiting an unprotected endpoint, potentially exposing environment files, SSH keys, cloud credentials, database passwords, and source code. This risk is particularly acute when developers expose their dev servers to network access for mobile testing purposes.

Technologies: @vitejs/plugin-rsc (npm). Vendors: npm.

Quick answers

Is CVE-2025-68155 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-68155 being exploited in the wild.
How severe is CVE-2025-68155?
Low severity, with a CVSS score of 3.1, published 16 December 2025.
Which products and versions are affected?
@vitejs/plugin-rsc (npm) SEMVER:introduced=0,fixed=0.5.8.
Is there a fix for CVE-2025-68155?
Yes. @vitejs/plugin-rsc (npm): upgrade to 0.5.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-68155 attacked?
It is attacked over the network.
Am I affected by CVE-2025-68155?
Check whether you run @vitejs/plugin-rsc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @vitejs/plugin-rsc (npm): upgrade to 0.5.8 or later
    npm install @vitejs/plugin-rsc@0.5.8

Technical details

The vulnerability is a path traversal / arbitrary file read in the `/__vite_rsc_findSourceMapURL` endpoint, which accepts a user-controlled `filename` query parameter without validation. The vulnerable code converts any `file://` URL to a filesystem path using `fileURLToPath()` and reads the file with `fs.readFileSync()`, returning the full file contents in the JSON response's `sourcesContent` field. The attack requires network reachability to the dev server (typically localhost:5173) and no authentication. Exploitation is straightforward: an attacker crafts a simple HTTP GET request with a `file://` URL pointing to sensitive files like `/etc/passwd`, `.env` files, or SSH keys. The fix (version 0.5.8+) adds proper path validation to ensure only legitimate source files within the project directory are read.

Affected products

  • Vitejs @vitejs/plugin-rsc <=0.5.7

Identifiers

  • CVE-2025-68155
  • GHSA-g239-q96q-x4qm

Timeline

  • 2025-12-16: disclosed
  • 2025-12-16: patched: Version 0.5.8 released with path validation fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.