High · published December 16, 2025
⚡ A single crafted HTTP request is all it takes to read any file on your server! Before version 0.5.8, the `@vitejs/plugin-rsc` allowed unauthenticated file read during development, leaving your secrets exposed! 🔥 Think of it like a restaurant where anyone can walk into the kitchen and check any recipe without permission, just because the door was left open. If a crafty individual knows the right questions to ask, they can access anything they want. This vulnerability could lead to an attacker gaining unauthorized access to sensitive files on your server, potentially exposing confidential information or critical source code. The ramifications could be absolutely devastating for both developers and users, as it leaves the door wide open for data leaks or exploitation.
Think of it like a restaurant where anyone can walk into the kitchen and check any recipe without permission, just because the door was left open. If a crafty individual knows the right questions to ask, they can access anything they want. The issue arises from the `/__vite_rsc_findSourceMapURL` endpoint, which allowed unauthenticated users to specify a `file://` URL in the `filename` query parameter, enabling arbitrary file reads on the server's file system during development mode.
This vulnerability could lead to an attacker gaining unauthorized access to sensitive files on your server, potentially exposing confidential information or critical source code. The ramifications could be absolutely devastating for both developers and users, as it leaves the door wide open for data leaks or exploitation. Upgrade your `@vitejs/plugin-rsc` to version 0.5.8 or later immediately to close this security hole! Additionally, ensure that you restrict access to development endpoints in production environments to prevent similar risks. You've got this! Secure your project and protect your files with these updates! 🛡️