CVE-2026-61782: 
JavaScript 취약성 분석 및 완화

CVE-2026-61782 is an unauthenticated information disclosure vulnerability in the @rsdoctor/rspack-plugin npm package (Rsdoctor), a build analyzer for Rspack-based projects. Prior to version 1.5.16, the default Rsdoctor report HTTP server binds to all network interfaces (0.0.0.0) and exposes a POST /api/data/key endpoint with no authentication and wildcard CORS (Access-Control-Allow-Origin: *), allowing any network-adjacent or remote attacker to exfiltrate full project source code and build metadata. All versions <= 1.5.15 of @rsdoctor/rspack-plugin are affected. The vulnerability was originally published on June 24, 2026, and added to the NVD on September 24, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) stems from four compounding design flaws in the Rsdoctor server (GitHub Advisory):

1. Unrestricted bind address: packages/utils/src/build/server.ts:107 calls server.listen(port, callback) without a host argument, causing Node.js to default to 0.0.0.0 and expose the server on all network interfaces.
2. Wildcard CORS: packages/sdk/src/sdk/server/index.ts:106 applies cors() with no origin restriction and explicitly sets Access-Control-Allow-Origin: * on every API response, enabling cross-origin browser-based attacks.
3. No authentication on POST /api/data/key: The route registered in packages/sdk/src/sdk/server/apis/data.ts has no authentication guard, token check, or session validation.
4. Unvalidated key parameter: The attacker-controlled key from the request body is passed directly to getStoreData() in packages/sdk/src/sdk/server/apis/base.ts with no allowlist, including support for dot-path traversal into nested data. The server starts automatically in all non-CI environments (disableClientServer defaults to false), and module source code is captured by default (noModuleSource, noAssetsAndModuleSource, and noCode all default to false).

Successful exploitation results in complete confidentiality loss of all build-time data. Any attacker reachable over LAN, VPN, shared Wi-Fi, or corporate network can retrieve the full JavaScript source code of every compiled module (including embedded API keys, secrets, and proprietary business logic via the moduleCodeMap key), serialized build configuration with absolute local file paths and plugin settings (configs), build error stack traces with internal paths (errors), and environment information (envinfo). A single unauthenticated HTTP POST request is sufficient, with no victim interaction required. The exposure is particularly severe for developers working on shared or semi-trusted networks, and for organizations whose CI systems run Rsdoctor in non-CI-detected environments (GitHub Advisory).

A detailed proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, including both a manual curl-based exploit and a Docker-based automated reproduction script (poc.py) (GitHub Advisory). The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable by any network-adjacent attacker. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.0036 (0.36%), indicating low but non-zero probability of exploitation in the near term (Feedly). The vulnerability is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify developer machines or build servers on the local network running Rsdoctor with @rsdoctor/rspack-plugin <= 1.5.15. Scan for open HTTP ports (commonly 3717 or similar dynamic ports) using tools like nmap or masscan.
2. Confirm Rsdoctor server: Access http://<target-ip>:<port>/index.html in a browser or via curl to confirm the Rsdoctor report UI is served, indicating the vulnerable server is running.
3. Exfiltrate module source code: Send an unauthenticated POST request to the /api/data/key endpoint with the key moduleCodeMap:

curl -s "http://<target-ip>:<port>/api/data/key" \
  -H 'Content-Type: application/json' \
  --data '{"key":"moduleCodeMap"}'

The response contains the full source code of all compiled JavaScript modules, including any embedded secrets or API keys. 4. Exfiltrate build configuration: Send a second request with the key configs to retrieve serialized build configuration including absolute file paths, resolver settings, and plugin configurations:

curl -s "http://<target-ip>:<port>/api/data/key" \
  -H 'Content-Type: application/json' \
  --data '{"key":"configs"}'

5. Browser-based attack (CORS abuse): From a malicious web page, exploit the wildcard CORS policy to exfiltrate data from a victim developer's local machine by targeting http://127.0.0.1:<port>/api/data/key via a fetch() call, bypassing same-origin restrictions (GitHub Advisory).

• Network: Unexpected inbound HTTP POST requests to /api/data/key on the Rsdoctor server port (commonly 3717) from non-localhost IP addresses; outbound HTTP responses containing large JSON payloads (e.g., moduleCodeMap responses of hundreds of kilobytes) to external hosts.
• Logs: HTTP access logs showing POST /api/data/key requests with Content-Type: application/json bodies containing {"key":"moduleCodeMap"} or {"key":"configs"} from unexpected source IPs; HTTP 200 responses to these requests.
• Process: Node.js process listening on 0.0.0.0 on a non-standard port during or after a build; the Rsdoctor server process remaining active after build completion and accepting connections from non-local addresses.
• File System: Presence of @rsdoctor/rspack-plugin version <= 1.5.15 in node_modules or package.json/package-lock.json of a project (GitHub Advisory).

Primary remediation: Upgrade @rsdoctor/rspack-plugin to version 1.5.16 or later, which binds the report server to 127.0.0.1 by default, restricts CORS to local origins only (localhost, *.localhost, 127.0.0.1, [::1]), and requires a per-server WebSocket token (GitHub Advisory):

pnpm add -D @rsdoctor/rspack-plugin@^1.5.16

Workarounds (if immediate upgrade is not possible):

• Disable the report server entirely: new RsdoctorRspackPlugin({ disableClientServer: true })
• Block external access to the Rsdoctor port with firewall rules
• Avoid using server.cors: true or server.cors.origin: '*'
• Run builds only in trusted, isolated network environments

Note that workarounds do not fully address all attack paths; upgrading is strongly recommended.

The vulnerability was credited to EQSTLab as the reporter and was published by maintainer chenjiahan of the web-infra-dev/rsdoctor repository (GitHub Advisory). The advisory includes a comprehensive technical write-up with a detailed source-to-sink data flow analysis and a Docker-based PoC, indicating a thorough security review process. Coverage was noted on The Hacker Wire and aggregated by multiple vulnerability tracking platforms shortly after disclosure (Feedly).