@vitejs/plugin-rsc CVE-2025-67489

Requires (1) a running Vite DEVELOPMENT server using @vitejs/plugin-rsc <= 0.5.5 in an RSC application that exposes server-function endpoints (the loadServerAction/decodeReply/decodeAction request handler, e.g. the /_.rsc route), and (2) network reachability to that dev server. The vulnerable code path is the development-mode dynamic import of server/client references, which accepts attacker-controlled 'data:' URL modules. LIMITING FACTORS: it affects dev servers ONLY (production builds are not exposed); the dev server binds to localhost by default, so remote exploitation realistically requires the developer to have run 'vite --host' (or equivalent binding) exposing the port on a reachable interface; no authentication or user interaction is needed once the endpoint is reachable.

The raw CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) reads as a critical, remotely-exploitable, unauthenticated RCE, and in isolation would demand emergency patching. However, this score materially overstates real-world risk because the flaw affects only the Vite DEVELOPMENT server, not production builds - a context CVSS base metrics cannot express. Contrasting signals align with this: EPSS is low at 0.81% (56th percentile), indicating no modeled likelihood of widespread opportunistic exploitation, and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation. A detailed, working proof-of-concept IS published in the GitHub Security Advisory (poc.js plus a StackBlitz repro), so publicly available exploit code exists and the technical barrier to abuse is trivial. Net assessment: this is a genuine code-injection (CWE-94) RCE that should be patched promptly by developers, but it is a developer-workstation / CI-exposure risk rather than an internet-facing production threat. The dev server binds to localhost by default; the high-severity scenario requires the developer to run 'vite --host' (or otherwise expose the port) on an untrusted network. The low EPSS despite a published POC is consistent with a developer-tooling vulnerability that is hard to reach at scale, not a mass-exploitation target.

A developer runs the RSC dev server with 'vite --host' on a shared or untrusted network. An attacker on that network sends a crafted POST to the /_.rsc server-function endpoint with an x-rsc-action header (or server-reference id) pointing at a 'data:text/javascript,...' URL, which the unsafe dynamic import loads and executes with Node.js privileges. A fully functional POC is published in the GHSA advisory, so exploitation is turnkey and the attacker gains arbitrary code execution to read files, steal environment variables/credentials, or pivot to internal services.