vite-plugin-react vulnerabilities

2 known vulnerabilities in vite-plugin-react from Vitejs. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  vite-plugin-react: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-68155Dec 16, 2025Vitejs

  @vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoint in `@vitejs/plugin-rsc` allows unauthenticated arbitrary file read during development mode. An attacker can read any

• 9.8 Critical severity

  vite-plugin-react: Improper Control of Generation of Code

  CVE-2025-67489Dec 9, 2025Vitejs

  @vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeRepl