CVE-2025-67489: Vitejs Plugin-RS RCE Vulnerability

CVE-2025-67489 Overview

CVE-2025-67489 is a critical remote code execution vulnerability affecting @vitejs/plugin-rs, a plugin that provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below contain unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction) that can be exploited when integrated into RSC applications exposing server function endpoints.

Attackers with network access to development servers running vulnerable versions can achieve arbitrary remote code execution, enabling them to read and modify files, exfiltrate sensitive data including source code, environment variables, and credentials, or pivot to other internal services. The risk is significantly amplified when developers use the vite --host flag to expose the development server on all network interfaces.

Critical Impact
Attackers can achieve full remote code execution on development servers, enabling data exfiltration, file manipulation, and lateral movement to internal services.

Affected Products

@vitejs/plugin-rs versions 0.5.5 and below
Vite applications using RSC with exposed server function endpoints
Development environments using vite --host flag

Discovery Timeline

2025-12-09 - CVE-2025-67489 published to NVD
2025-12-12 - Last updated in NVD database

Technical Details for CVE-2025-67489

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw exists in the server function APIs of @vitejs/plugin-rs, specifically in the loadServerAction, decodeReply, and decodeAction functions. These functions perform unsafe dynamic imports without proper input validation or sanitization, allowing attackers to inject and execute arbitrary code.

The vulnerability is exploitable remotely with no authentication required and no user interaction necessary. When exploited, an attacker gains complete control over the development server, with the ability to compromise confidentiality, integrity, and availability of the system.

Root Cause

The root cause is improper handling of dynamic imports within the server function APIs. The loadServerAction, decodeReply, and decodeAction functions accept user-controlled input that is used directly in dynamic import operations without adequate validation. This allows malicious actors to supply crafted payloads that result in arbitrary code execution on the server.

Attack Vector

The attack is conducted over the network against development servers running vulnerable versions of @vitejs/plugin-rs. An attacker who can reach the development server—either on a local network or when the server is exposed via vite --host—can send specially crafted requests to server function endpoints.

The malicious payload targets the unsafe dynamic import handling in the RSC server function APIs. Upon successful exploitation, the attacker can execute arbitrary JavaScript code in the context of the Node.js development server process, granting full system access with the privileges of the server process.

The vulnerability specifically manifests in how server function identifiers are processed through the loadServerAction, decodeReply, and decodeAction functions. Without proper sanitization, these functions allow import paths to be manipulated, enabling code injection. For detailed technical information about the vulnerability mechanism, see the GitHub Security Advisory.

Detection Methods for CVE-2025-67489

Indicators of Compromise

Unexpected outbound network connections from development server processes
Unusual file system access patterns or modifications to source code files
Environment variable or credential access attempts in server logs
Abnormal server function endpoint requests with malformed or encoded payloads
Process spawning from Node.js development server process

Detection Strategies

Monitor network traffic to development servers for anomalous requests targeting server function endpoints
Implement application logging to capture all requests to RSC server function APIs
Review dependency versions in package.json and package-lock.json for vulnerable @vitejs/plugin-rs versions
Use software composition analysis (SCA) tools to identify vulnerable dependencies in CI/CD pipelines

Monitoring Recommendations

Enable verbose logging on Vite development servers during the vulnerability window
Monitor for process execution and file system changes originating from Node.js processes
Set up alerts for network connections to unexpected internal services from development environments
Track dependency updates and enforce version pinning for security-critical packages

How to Mitigate CVE-2025-67489

Immediate Actions Required

Upgrade @vitejs/plugin-rs to version 0.5.6 or later immediately
Avoid using the vite --host flag until the upgrade is complete
Restrict network access to development servers to trusted hosts only
Audit development environments for signs of compromise if previously exposed

Patch Information

The vulnerability has been fixed in @vitejs/plugin-rs version 0.5.6. The fix addresses the unsafe dynamic import handling in the server function APIs. The patch can be reviewed in the GitHub commit fe634b58.

To update the package, run the appropriate package manager command in your project directory.

Workarounds

Do not expose development servers to untrusted networks
Remove the --host flag from Vite development scripts
Use firewall rules to restrict access to development server ports
Consider using a VPN for remote development instead of exposing servers directly

bash

# Update @vitejs/plugin-rs to the patched version
npm update @vitejs/plugin-rs@0.5.6

# Or using yarn
yarn upgrade @vitejs/plugin-rs@0.5.6

# Or using pnpm
pnpm update @vitejs/plugin-rs@0.5.6