CVE-2025-68155: Arbitrary File Access in @vitejs/plugin-rsc

The primary impact of CVE-2025-68155 is the potential for unauthorized file disclosure. An attacker can leverage this vulnerability to read sensitive files within the Node.js process's accessible file system. This could include configuration files containing credentials, source code with API keys, or other confidential data. While limited to development mode, this vulnerability presents a significant risk as development environments often contain more sensitive information than production systems. The attack vector is straightforward: a crafted HTTP request with a file:// URL in the filename parameter allows the attacker to specify the file to be read. There are no privilege requirements, making exploitation accessible to unauthenticated users.

1. Reserved2025-12-15
2. Published2025-12-16
3. EPSS updated2026-03-23

The recommended mitigation for CVE-2025-68155 is to immediately upgrade the @vitejs/plugin-rsc package to version 0.5.8 or later. This version includes a fix that prevents the arbitrary file access. If upgrading is not immediately feasible, consider restricting access to the /viterscfindSourceMapURL endpoint during development. This can be achieved through firewall rules or proxy configurations. Additionally, carefully review file permissions within the Node.js process to minimize the potential impact of a successful exploit. After upgrading, confirm the fix by attempting to access the /viterscfindSourceMapURL endpoint with a file:// URL; the request should be denied.