GHSA-fmh4-wr37-44fp React Server Components are Vulnerable to RCE

• npm @vitejs/plugin-rsc: < 0.5.3 → fixed in 0.5.3

Summary `@vitejs/plugin-rsc` vendors `react-server-dom-webpack`, which contained an unauthenticated remote code execution vulnerability in versions prior to 19.0.1, 19.1.2, and 19.2.1. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r Impact Applications using affected versions of `@vitejs/plugin-rsc` are vulnerable to unauthenticated remote code execution through deserialization of untrusted data. An attacker can execute arbitrary code remotely without authentication, affecting confidentiality, integrity, and availability. Recommendations Upgrade immediately to `@vitejs/[email protected]` or later. Workarounds Applications not using server-side React or React Server Components are unaffected.