External risk intelligence

Vite plugin React Server Components Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-67489

The vulnerability is limited to development servers used during the software build and development process. It is not designed for public-facing production environments. While some configurations allow network access to these servers, they are typically isolated within internal developer environments or private networks, making public internet exposure rare and contrary to standard deployment practices.

Code Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Vite's development server when using a specific plugin for React Server Components. If exploited, it could allow an attacker with network access to remotely execute code, potentially leading to data theft or unauthorized access to internal services. The risk is amplified if the development server is exposed on all network interfaces.

Code execution risk during development.
High severity, impacts code integrity.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

Attackers with network access to a Vite development server running a vulnerable plugin can exploit unsafe dynamic imports within server function APIs. This allows them to execute arbitrary code remotely, leading to severe consequences like reading or modifying files, stealing sensitive data such as source code and credentials, and potentially pivoting to other internal systems. The risk is amplified when the development server is exposed to all network interfaces.

Network access to development server.
Triggering unsafe dynamic imports in server functions.
Arbitrary code execution and data exfiltration.

Live Threat

Current exploitation, exposure, and threat context

When integrated into React Server Components applications, unsafe dynamic imports in server function APIs could allow an attacker with network access to the development server to execute arbitrary code. This could lead to unauthorized reading or modification of files, exfiltration of sensitive data such as source code or credentials, or pivoting to other internal services, particularly when the development server is exposed to all network interfaces.

Source code and sensitive data.
Unsafe dynamic imports enable execution.
System compromise and data exfiltration.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that this vulnerability affects development servers, application owners and platform teams are likely responsible for identifying and mitigating the risk. The first practical step is to determine where the affected Vite development servers are deployed, confirm their network reachability and business criticality, and then identify the accountable owner to plan remediation based on the associated risk.

Application and platform teams own remediation.
Verify development server network exposure and criticality.
Plan updates based on exposure and business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is @vitejs/plugin-rs and why is it used?

This component is a Vite plugin designed to enable React Server Components (RSC) support. Developers use it to build modern web applications that utilize server-side logic and rendering within the Vite development ecosystem, streamlining the development of integrated client-server React applications.

What does CVE-2025-67489 mean for my application?

This CVE represents a security weakness classified as CWE-94, or improper control of generation of code. Essentially, the plugin fails to safely handle dynamic imports within its server function APIs. This flaw allows an attacker to manipulate how the development server processes specific requests, potentially forcing it to execute unauthorized commands or arbitrary code on the underlying machine.

How is this vulnerability triggered?

An attacker triggers the vulnerability by sending malicious input to specific server function APIs, such as loadServerAction, that the plugin uses to decode data. Simply running the development server does not trigger the bug; it requires active network interaction with these APIs. Requests sent to unrelated endpoints or standard static assets do not activate the unsafe import path.

Is my development environment at risk?

Halo Surface Signal indicates that exploitation is very unlikely because this plugin is used in development environments rather than public-facing production sites. You are primarily at risk if you use the 'vite --host' flag, which exposes your development server to the broader network rather than keeping it isolated to your local machine.

How do I secure my environment against this flaw?

The most effective way to address this is to update @vitejs/plugin-rs to version 0.5.6 or higher, which contains the fix for these unsafe imports. Additionally, verify your development server configuration and ensure that you are not unnecessarily exposing your internal build services to external network interfaces or untrusted users.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.