ViteJS plugin @vitejs/plugin-rsc contains a critical path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server.

The vulnerability is an improper limitation of a pathname, specifically a path traversal flaw, which allows an unauthenticated remote attacker to read files accessible to the Node.js process by supplying a crafted file:// URL to the filename parameter.

Successful exploitation of this vulnerability permits unauthorized access to sensitive system files, configuration data, or source code. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to the confidentiality of the development environment. If development servers are connected to internal networks or contain secrets, this exposure could facilitate lateral movement or further system compromise.

Immediate Action: Update the @vitejs/plugin-rsc package to version 0.5.8 or later immediately.

Proactive Monitoring: Monitor server access logs for anomalous requests targeting the /__vite_rsc_findSourceMapURL endpoint, especially those containing file:// patterns or suspicious directory traversal characters.

Compensating Controls: Ensure that development environments are not exposed to the public internet and use network-level access controls to restrict access to the Vite development server port.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to development infrastructure, as it provides a direct path for information disclosure without requiring authentication. Organizations using @vitejs/plugin-rsc in their development workflows must prioritize updating to version 0.5.8 to eliminate this exposure. Failure to apply this patch leaves development systems vulnerable to unauthorized file access by any remote actor with network visibility.