Executive brief
Vite Plugin React, a build tool plugin used to bundle React applications with server-side rendering capabilities, contains a source code exposure vulnerability. An unauthenticated attacker can access sensitive source code that should remain private on the server, potentially revealing trade secrets, API keys, or other confidential business logic.
Technical details
The vulnerability resides in react-server-dom-webpack (vendored by @vitejs/plugin-rsc), which improperly handles source code exposure in React Server Components. The root cause involves deserialization of untrusted data and exposure of sensitive system information without proper access controls (CWE-497, CWE-502). Attack is network-reachable with no authentication or user interaction required. An unauthenticated attacker can retrieve source code from the server that should not be accessible on the client side. The vulnerability has been patched in @vitejs/plugin-rsc version 0.5.7 and corresponding React packages (react-server-dom-webpack 19.2.2, react-server-dom-parcel 19.2.2, react-server-dom-turbopack 19.2.2).
Affected products
- Vite Plugin React <= 0.5.6
- Facebook react-server-dom-webpack 19.0.0-19.0.1, 19.1.0-19.1.2, 19.2.0-19.2.1
- Facebook react-server-dom-parcel 19.0.0-19.0.1, 19.1.0-19.1.2, 19.2.0-19.2.1
- Facebook react-server-dom-turbopack 19.0.0-19.0.1, 19.1.0-19.1.2, 19.2.0-19.2.1
Timeline
- 2025-12-11: disclosed: React advisory GHSA-925w-6v3x-g4j4 published
- 2025-12-12: disclosed: Vite Plugin React advisory GHSA-c6m7-q6pr-c64r published
- 2025-12-12: patched: @vitejs/plugin-rsc version 0.5.7 released; React packages 19.0.2, 19.1.3, 19.2.2 released