https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T13:08:59.278980+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-263815 EUVD-2026-263815 2026-10-06T13:08:59.329281+00:00 EUVD-2026-263815 https://cve.radiocsirt.org/vuln/fkie_cve-2025-68155 fkie_cve-2025-68155 2026-10-06T13:08:59.329319+00:00

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoint in `@vitejs/plugin-rsc` allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a `file://` URL in the `filename` query parameter. Version 0.5.8 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-g239-q96q-x4qm GHSA-g239-q96q-x4qm — @vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint 2026-10-06T13:08:59.329355+00:00

Affected: npm: @vitejs/plugin-rsc

## Summary

The `/__vite_rsc_findSourceMapURL` endpoint in `@vitejs/plugin-rsc` allows **unauthenticated arbitrary file read** during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a `file://` URL in the `filename` query parameter.

**Severity:** High **Attack Vector:** Network **Privileges Required:** None **Scope:** Development mode only (`vite dev`)

---

## Impact

### Who Is Affected?

- **All developers** using `@vitejs/plugin-rsc` during development - Projects running `vite dev` with the RSC plugin enabled

### Attack Scenarios

1. **Network-Exposed Dev Servers:** When developers run `vite --host 0.0.0.0` (common for mobile testing), attackers on the same network can read files.

2. ~**XSS-Based Attacks:**~ ~If the application has an XSS vulnerability, malicious JavaScript can fetch sensitive files and exfiltrate them.~

3. ~**Malicious Dependencies:** ~ ~A compromised npm package could include code that reads files during development.~

4. ~**DNS Rebinding:**~ (EDIT: This doesn't apply since https://github.com/vitejs/vite/pull/20222) ~An attacker could use DNS rebinding to access the localhost dev server from a malicious website.~

### What Can Be Leaked?

- Environment files (`.env`, `.env.local`, `.env.production`) - SSH keys (`~/.ssh/id_rsa`, `~/.ssh/id_ed25519`) - Cloud credentials (`~/.aws/credentials`, `~/.config/gcloud/`) - Database passwords and API keys - Source code…