# Vite Plugin React source code exposure in Server Components

Source: https://junglewise.ai/threats/vite-plugin-react-source-code-exposure-in-server-components-88776524  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2025-12-12

Vite Plugin React, a build tool plugin used to bundle React applications with server-side rendering capabilities, contains a source code exposure vulnerability. An unauthenticated attacker can access sensitive source code that should remain private on the server, potentially revealing trade secrets, API keys, or other confidential business logic.

Technologies: [@vitejs/plugin-rsc (npm)](https://junglewise.ai/threats/technologies/vitejs-plugin-rsc). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Vite](https://junglewise.ai/threats/vendors/vite).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 12 December 2025.

**Which products and versions are affected?** @vitejs/plugin-rsc (npm) SEMVER:introduced=0,fixed=0.5.7; Vite Plugin React <= 0.5.6.

**Is there a fix for This vulnerability?** Yes. @vitejs/plugin-rsc (npm): upgrade to 0.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run @vitejs/plugin-rsc (npm) or Vite Plugin React at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @vitejs/plugin-rsc (npm): upgrade to 0.5.7 or later

  ```sh
  npm install @vitejs/plugin-rsc@0.5.7
  ```


## Technical details

The vulnerability resides in react-server-dom-webpack (vendored by @vitejs/plugin-rsc), which improperly handles source code exposure in React Server Components. The root cause involves deserialization of untrusted data and exposure of sensitive system information without proper access controls (CWE-497, CWE-502). Attack is network-reachable with no authentication or user interaction required. An unauthenticated attacker can retrieve source code from the server that should not be accessible on the client side. The vulnerability has been patched in @vitejs/plugin-rsc version 0.5.7 and corresponding React packages (react-server-dom-webpack 19.2.2, react-server-dom-parcel 19.2.2, react-server-dom-turbopack 19.2.2).

## Affected products

- Vite Plugin React <= 0.5.6
- Facebook react-server-dom-webpack 19.0.0-19.0.1, 19.1.0-19.1.2, 19.2.0-19.2.1
- Facebook react-server-dom-parcel 19.0.0-19.0.1, 19.1.0-19.1.2, 19.2.0-19.2.1
- Facebook react-server-dom-turbopack 19.0.0-19.0.1, 19.1.0-19.1.2, 19.2.0-19.2.1

## Timeline

- 2025-12-11: disclosed: React advisory GHSA-925w-6v3x-g4j4 published
- 2025-12-12: disclosed: Vite Plugin React advisory GHSA-c6m7-q6pr-c64r published
- 2025-12-12: patched: @vitejs/plugin-rsc version 0.5.7 released; React packages 19.0.2, 19.1.3, 19.2.2 released

## References

- [https://github.com/facebook/react/security/advisories/GHSA-925w-6v3x-g4j4](https://github.com/facebook/react/security/advisories/GHSA-925w-6v3x-g4j4)
- [https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-c6m7-q6pr-c64r](https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-c6m7-q6pr-c64r)

## Related threats

- [Vitejs plugin-rsc denial of service in React Server Components](https://junglewise.ai/threats/vitejs-plugin-rsc-denial-of-service-in-react-server-components-a8d7aac1)
- [Vitejs plugin-rsc Denial of Service with React Server Components](https://junglewise.ai/threats/vitejs-plugin-rsc-denial-of-service-with-react-server-components-d98230f7)
- [Vite @vitejs/plugin-rsc arbitrary file read in /__vite_rsc_findSourceMapURL](https://junglewise.ai/threats/cve-2025-68155-vite-vitejs-plugin-rsc-arbitrary-file-read-in-vite-rsc)
- [Vite Plugin React denial of service in React Server Components](https://junglewise.ai/threats/vite-plugin-react-denial-of-service-in-react-server-components-8f1b9330)
- [Vitejs plugin-rsc code injection in development server](https://junglewise.ai/threats/cve-2025-67489-vitejs-plugin-rsc-code-injection-in-development-server)