CVE-2025-67489
Published: 09 December 2025
Description
@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction) when integrated into RSC applications…
more
that expose server function endpoints. Attackers with network access to the development server can read/modify files, exfiltrate sensitive data (source code, environment variables, credentials), or pivot to other internal services. While this affects development servers only, the risk increases when using vite --host to expose the server on all network interfaces. This issue is fixed in version 0.5.6.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely remediation by updating the vulnerable @vitejs/plugin-rs package to version 0.5.6 or later to eliminate the unsafe dynamic imports enabling arbitrary RCE.
Enforces network boundary protections to block unauthorized access to the exposed development server, mitigating remote exploitation over the network.
Mandates secure configuration settings for Vite development servers, such as avoiding --host to bind only to localhost, reducing network exposure risk.
Security SummaryAI
CVE-2025-67489 is an arbitrary remote code execution vulnerability in the @vitejs/plugin-rs package, which provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are affected due to unsafe dynamic imports in server function APIs, including loadServerAction, decodeReply, and decodeAction. This issue arises specifically on the development server when the plugin is integrated into RSC applications that expose server function endpoints. The vulnerability is classified under CWE-94 (code injection) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Attackers with network access to the vulnerable development server can exploit this flaw to execute arbitrary code. Successful exploitation enables reading or modifying files, exfiltrating sensitive data such as source code, environment variables, and credentials, or pivoting to other internal services. While the vulnerability is confined to development servers, the risk escalates when developers use the vite --host flag to bind the server to all network interfaces, making it remotely accessible.
The issue is addressed in version 0.5.6 of @vitejs/plugin-rs. Developers should update to this version or later to mitigate the vulnerability. Additional details on the fix are provided in the GitHub security advisory (GHSA-j76j-5p5g-9wfr) and the associated commit (fe634b58210d0a4a146a7faae56cd71af3bb9af4).
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows arbitrary remote code execution on a network-exposed development server without authentication, directly mapping to exploitation of a public-facing application.