CVE-2025-68155

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoint in `@vitejs/plugin-rsc` allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a `file://` URL in the `filename` query parameter. Version 0.5.8 fixes the issue.

• CWE-22
• CWE-73

• https://github.com/facebook/react/pull/29708
• https://github.com/facebook/react/pull/30741
• https://github.com/vitejs/vite-plugin-react/commit/582fba0b9a52b13fcff6beaaa3bfbd532bc5359d
• https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-g239-q96q-x4qm

Published

Dec 16, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6815The LatePoint – Calendar Booking Plugin for Appointments and…5.5
• CVE-2025-68150Parse Server is an open source backend that can be deployed …6.5
• CVE-2025-68151CoreDNS is a DNS server that chains plugins. Prior to versio…7.5
• CVE-2025-68152Juju is an open source application orchestration engine that…4.9
• CVE-2025-68153Juju is an open source application orchestration engine that…6.5
• CVE-2025-68154systeminformation is a System and OS information library for…8.1
• CVE-2025-68156Expr is an expression language and expression evaluation for…7.5
• CVE-2025-68157Webpack is a module bundler. From version 5.49.0 to before 5…3.7
• CVE-2025-68158Authlib is a Python library which builds OAuth and OpenID Co…8.8
• CVE-2025-6816A vulnerability classified as problematic was found in HDF5 …3.3
• CVE-2025-68160Issue summary: Writing large, newline-free data into a BIO c…4.7
• CVE-2025-68161The Socket Appender in Apache Log4j Core versions 2.0-beta9 …4.8