CVE-2025-67489: RCE in @vitejs/plugin-react

An attacker with network access to the vulnerable development server can exploit this vulnerability to achieve arbitrary code execution. This allows them to read and modify files on the server, potentially exfiltrating sensitive data such as source code, environment variables, and credentials. The attacker could also pivot to other internal services, significantly expanding the scope of the attack. This vulnerability specifically targets development servers, but the potential for data compromise and system takeover remains severe.

1. Reserved2025-12-08
2. Published2025-12-09
3. Modified2025-12-10
4. EPSS updated2026-03-23

The primary mitigation is to upgrade to @vitejs/plugin-react version 0.5.6 or later, which addresses the vulnerability. If upgrading is not immediately feasible, implement strict input validation and sanitization for all data passed to server function APIs. Carefully review and restrict the use of dynamic imports within these functions. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests targeting server function endpoints. After upgrade, confirm by attempting to trigger the vulnerable dynamic import and verifying that it no longer results in code execution.