Arbitrary File Read Vulnerability in @vitejs/plugin-rsc for Vite

CVE-2025-68155

What is CVE-2025-68155?

The @vitejs/plugin-rsc, which provides support for React Server Components within Vite, has a critical vulnerability in versions before 0.5.8. This flaw allows attackers to exploit the /__vite_rsc_findSourceMapURL endpoint during development mode, permitting unauthorized access to any file that is reachable by the Node.js process. By crafting a specific HTTP request and manipulating the filename query parameter to include a file:// URL, an attacker can gain access to sensitive files, posing a significant threat to application security. Users are encouraged to update to version 0.5.8 or later, which resolves this issue.

References