Rsdoctor
Monthly
Unauthenticated information disclosure in Rsdoctor prior to 1.5.16 allows remote attackers to retrieve complete source code of compiled JavaScript modules, serialized build configuration, error details, and other build metadata from the default report HTTP server started by @rsdoctor/rspack-plugin. The server binds to all interfaces (0.0.0.0), exposes POST /api/data/key with no authentication, and returns wildcard CORS (Access-Control-Allow-Origin: *), so any network-adjacent or remote attacker with reachability to the port - or a victim developer lured to a malicious page that abuses the CORS header - can pull sensitive data with a single unauthenticated request while a non-CI build session is live. Exploitation is favored by the fact that the server is enabled by default with no victim configuration, though exposure is limited to developer workstations during active builds rather than production systems; no public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing).
Unauthenticated information disclosure in Rsdoctor prior to 1.5.16 allows remote attackers to retrieve complete source code of compiled JavaScript modules, serialized build configuration, error details, and other build metadata from the default report HTTP server started by @rsdoctor/rspack-plugin. The server binds to all interfaces (0.0.0.0), exposes POST /api/data/key with no authentication, and returns wildcard CORS (Access-Control-Allow-Origin: *), so any network-adjacent or remote attacker with reachability to the port - or a victim developer lured to a malicious page that abuses the CORS header - can pull sensitive data with a single unauthenticated request while a non-CI build session is live. Exploitation is favored by the fact that the server is enabled by default with no victim configuration, though exposure is limited to developer workstations during active builds rather than production systems; no public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing).