@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server

An attacker with network access to the vulnerable development server can exploit this vulnerability to achieve arbitrary code execution. This allows them to read and modify files on the server, potentially exfiltrating sensitive data such as source code, environment variables, and credentials. The attacker could also pivot to other internal services, significantly expanding the scope of the attack. This vulnerability specifically targets development servers, but the potential for data compromise and system takeover remains severe.

Development teams using @vitejs/plugin-react to build React Server Component applications are at risk. Specifically, those using versions 0.5.5 or earlier and exposing server function endpoints are particularly vulnerable. Shared hosting environments where developers have access to the development server are also at increased risk.

• react / development server:

# Check for vulnerable plugin versions in package.json
grep '@vitejs/plugin-react' package.json

• react / development server:

# Monitor server logs for suspicious dynamic import calls
# (specific patterns will depend on RSC implementation)
grep 'dynamic import' server.log

1. 2025-12-09Disclosure

   disclosure

1. Reserviert2025-12-08
2. Veröffentlicht2025-12-09
3. Geändert2025-12-10
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade to @vitejs/plugin-react version 0.5.6 or later, which addresses the vulnerability. If upgrading is not immediately feasible, implement strict input validation and sanitization for all data passed to server function APIs. Carefully review and restrict the use of dynamic imports within these functions. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests targeting server function endpoints. After upgrade, confirm by attempting to trigger the vulnerable dynamic import and verifying that it no longer results in code execution.