CVE-2025-68155 @vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development
An attacker can read arbitrary files via a crafted request to the development endpoint in the Vite RSC plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68155?
CVE-2025-68155 is a high-severity path traversal vulnerability in vitejs vite-plugin-react, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoint in `@vitejs/plugin-rsc` allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a `file://` URL in the `filename` query parameter. Version 0.5.8 fixes the issue.
Which versions are affected by CVE-2025-68155?
2 open source packages ship an affected version, including @vitejs/plugin-rsc.
| Package | Affected | Fixed in |
|---|---|---|
@vitejs/plugin-rsc npm | All versions | 0.5.8 |
@vitejs/plugin-rsc npm | All versions | 0.5.8 |
How do I fix CVE-2025-68155?
Upgrade @vitejs/plugin-rsc to 0.5.8 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-68155 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68155 exists.
Sources
Also known as GHSA-g239-q96q-x4qm.