Executive brief
Rsdoctor is a developer build analysis tool that starts an HTTP server during the build process. By default, this server binds to all network interfaces without authentication and exposes project source code, build configuration, and error details via an unauthenticated API endpoint. A developer's build output could be retrieved by anyone on the same network without any password or token, exposing compiled JavaScript source, secrets, and internal paths.
Technical details
The vulnerability is a network-accessible information disclosure caused by four compounding configuration issues: (1) the HTTP server binds to 0.0.0.0 with no host argument, (2) wildcard CORS is applied unconditionally, (3) the POST /api/data/key endpoint has no authentication middleware, and (4) the key parameter is used directly to index the entire SDK data store without an allowlist. An attacker on the LAN or with network access can send a single unauthenticated POST request with {"key":"moduleCodeMap"} to retrieve all compiled module source code including hardcoded secrets, or {"key":"configs"} to retrieve serialized build configuration with absolute file paths. The server starts automatically in non-CI environments by default (disableClientServer defaults to false). The fix binds to 127.0.0.1 by default, restricts CORS to local origins, and requires a token for WebSocket access.
Affected products
- Rsdoctor rspack-plugin <1.5.16
Timeline
- 2026-09-24: disclosed
- 2026-09-24: patched: Version 1.5.16+ includes fixes