EUVD-2026-86323
GHSA-jmg2-rcxh-w8q3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify dev host running Rsdoctor server on 0.0.0.0
-
ExploitSend unauthenticated POST /api/data/key
-
ExecutionServer returns moduleCodeMap and configs
-
ImpactExfiltrate full source code and build metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Rsdoctor report HTTP server (started by @rsdoctor/rspack-plugin) to be actively running, which happens by default in non-CI environments during a build - no victim configuration needed. The attacker must have network reachability to the developer's machine on the report server's port while the build/analysis session is live (the server binds 0.0.0.0), or must lure the developer's browser to a malicious page that abuses the wildcard CORS (Access-Control-Allow-Origin: *) to read the response. Key limiting factors: the server is transient (only up during active dev builds, not in CI), the tool runs on developer workstations rather than production, and reach is typically LAN/adjacent unless the port is deliberately exposed. |
| Impact | All signals align on this being a genuine, easily-triggered information-disclosure flaw rather than a paper high-CVSS issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 7.5) indicates a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, and the description corroborates this exactly: the server binds to 0.0.0.0 with no auth and wildcard CORS, so a single request suffices. Impact is scoped to confidentiality only (C:H/I:N/A:N), consistent with CWE-200. However, the raw network vector overstates practical reach: the Rsdoctor report server is a developer-side, build-time tool that is only listening while a developer is actively running a non-CI build, so exploitation is transient and typically limited to the developer's LAN/adjacent network rather than the open internet. No EPSS score, KEV listing, or POC is provided; per precision rules this is 'no public exploit identified at time of analysis.' The absence of EPSS/KEV data is expected for a recently-disclosed dev-tooling CVE and does not lower the underlying technical severity - where the server is reachable, disclosure of full compiled source and build config is trivial. |
| Exploit ScenarioDerived | A developer runs an Rspack build with @rsdoctor/rspack-plugin on a shared office/coffee-shop network or a container with an exposed port; the report server silently listens on 0.0.0.0 with no authentication. An attacker on the same network (or via a malicious website abusing the wildcard CORS from the developer's browser) sends one unauthenticated POST to /api/data/key and receives moduleCodeMap (full source of all compiled modules), serialized build configs, and error details. No public exploit code is identified at time of analysis, but the attack is a single trivial HTTP request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Unauthenticated information disclosure in Rsdoctor prior to 1.5.16 allows remote attackers to retrieve complete source code of compiled JavaScript modules, serialized build configuration, error details, and other build metadata from the default report HTTP server started by @rsdoctor/rspack-plugin. The server binds to all interfaces (0.0.0.0), exposes POST /api/data/key with no authentication, and returns wildcard CORS (Access-Control-Allow-Origin: *), so any network-adjacent or remote attacker with reachability to the port - or a victim developer lured to a malicious page that abuses the CORS header - can pull sensitive data with a single unauthenticated request while a non-CI build session is live. Exploitation is favored by the fact that the server is enabled by default with no victim configuration, though exposure is limited to developer workstations during active builds rather than production systems; no public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing).
RemediationAI
Vendor-released patch: upgrade @rsdoctor/rspack-plugin (and the Rsdoctor packages) to version 1.5.16 or later, which corrects the default binding and endpoint exposure; patch availability and version guidance are documented in the GitHub security advisory https://github.com/web-infra-dev/rsdoctor/security/advisories/GHSA-jmg2-rcxh-w8q3. Until the upgrade can be rolled out, compensating controls should target the network path and the endpoint itself: run development builds in an isolated/trusted network segment or on a host with a local firewall rule that blocks inbound access to the report server port so that only loopback clients can connect (trade-off: blocks legitimate LAN-based report viewing from other machines); explicitly configure the report server to bind to 127.0.0.1 rather than 0.0.0.0 if the plugin exposes that option, or disable the report server entirely during sensitive work (trade-off: loses build visualization); avoid running untrusted browser content in the same browser session that can reach the localhost port, since the wildcard Access-Control-Allow-Origin header allows cross-origin reads (trade-off: operational inconvenience); and stop or avoid leaving build/analysis sessions running for extended periods, since the server is transient and exposure ends when the session ends. Because the endpoint requires no authentication and the CORS header is wildcard, there is no credential-based mitigation available - network restriction and the 1.5.16 upgrade are the effective fixes. No public exploit code was identified at time of analysis, and no CISA KEV entry indicates confirmed active exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Rsdoctor is a build analyzer tailored for Rspack, a Rust-based, webpack-compatible JavaScript bundler; its @rsdoctor/rspack-plugin launches a local HTTP report server that developers use to inspect bundle composition, module graphs, and build diagnostics. In versions prior to 1.5.16 that server binds to 0.0.0.0 rather than loopback and exposes the data endpoint POST /api/data/key without any authentication or authorization check, while also returning Access-Control-Allow-Origin: * on responses. That combination is a classic CWE-200 Exposure of Sensitive Information to an Unauthorized Actor: the endpoint serializes the internal moduleCodeMap (the full source text of every compiled JavaScript module), the resolved configs structure, error records, and related build metadata, then serves it to any client that can reach the socket. Because the wildcard CORS header permits cross-origin reads of a credentialed-free endpoint, a developer's browser can be induced to fetch and exfiltrate the response from a page the developer merely visits, even where the port is not directly reachable from the internet. The server is transient - it exists only while a development build/analysis session runs and is not started in CI - which constrains, but does not eliminate, the window of exposure; per the authoritative assessment the flaw is a genuine, easily-triggered disclosure issue rather than a paper high-severity finding, with impact limited to confidentiality (C:H, I:N, A:N) and reach typically LAN/adjacent unless the port is deliberately exposed.
Know when Rsdoctor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Server binds 0.0.0.0 with no auth and wildcard CORS (AV:N/AC:L/PR:N/UI:N); full source and config disclosure with no write/availability impact gives C:H/I:N/A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces (0.0.0.0) and serves a POST /api/data/key endpoint with no authentication and wildcard CORS (Access-Control-Allow-Origin: *). Any network-adjacent or remote attacker can send a single unauthenticated request to retrieve the full source code of all compiled JavaScript modules (moduleCodeMap), serialized build configuration (configs), error details, and other sensitive build metadata. This server is enabled by default in non-CI environments, requiring no special configuration from the victim developer. Version 1.5.16 patches the issue.
Technical POC Analysis
CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Rsdoctor, a build analysis tool used by development teams, exposes complete source code, build configuration, and error details through its default report HTTP server, potentially leaking intellectual property from developer workstations during active builds. This affects engineering organizations and could enable further targeted attacks, though production systems remain unaffected. No public exploit identified at time of analysis, but the vulnerability is remotely reachable and no vendor-released patch is currently available.
Disable the default report HTTP server, bind it to localhost only, and block inbound access to the server port at host and network firewalls. Avoid running non-CI builds on untrusted networks. Monitor for anomalous POST requests to /api/data/key. No vendor-released patch identified at time of analysis; apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB