GitHub Advisoryadvisory · npm

GHSA-c6m7-q6pr-c64r Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components

MEDIUM Published 2025-12-12 Modified 2025-12-12 Official page ↗
Ecosystem
npm
Packages
@vitejs/plugin-rsc
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-1395, CWE-497, CWE-502
Reviewed
2025-12-12

Affected packages

• npm @vitejs/plugin-rsc: < 0.5.7 → fixed in 0.5.7

Description

Impact `@vitejs/plugin-rsc` vendors `react-server-dom-webpack`, which contained a vulnerability in versions prior to 19.2.3. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-925w-6v3x-g4j4 Patches Upgrade immediately to `@vitejs/[email protected]` or later.

Related

Weakness · CWE (3)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness
  • CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References