CVE-2025-67489 @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server
Attackers can execute arbitrary code on exposed Vite development servers via unsafe dynamic imports, risking data theft and system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-67489?
CVE-2025-67489 is a critical code injection vulnerability in vitejs vite-plugin-react, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction) when integrated into RSC applications that expose server function endpoints. Attackers with network access to the development server can read/modify files, exfiltrate sensitive data (source code, environment variables, credentials), or pivot to other internal services. While this affects development servers only, the risk increases when using vite --host to expose the server on all network interfaces. This issue is fixed in version 0.5.6.
Weakness: CWE-94
Which versions are affected by CVE-2025-67489?
2 open source packages ship an affected version, including @vitejs/plugin-rsc.
| Package | Affected | Fixed in |
|---|---|---|
@vitejs/plugin-rsc npm | All versions | 0.5.6 |
@vitejs/plugin-rsc npm | All versions | 0.5.6 |
How do I fix CVE-2025-67489?
Upgrade @vitejs/plugin-rsc to 0.5.6 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-67489 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-67489 exists.
Sources
Also known as GHSA-j76j-5p5g-9wfr.