-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @vitejs/plugin-rsc | npm | <= 0.5.5 | 0.5.6 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the unsafe use of dynamic import() with user-controlled input within the @vitejs/plugin-rsc package, specifically affecting the development server. The analysis of the patch commit fe634b58210d0a4a146a7faae56cd71af3bb9af4 reveals that the core issue is in the anonymous load functions defined inside an initialize function in both packages/plugin-rsc/src/rsc.tsx and packages/plugin-rsc/src/ssr.tsx. These functions are responsible for dynamically loading modules based on an id parameter.
The vulnerability description states that server function APIs like loadServerAction, decodeReply, and decodeAction are the entry points. These APIs internally use the vulnerable load function to resolve and import modules. An attacker could craft a request to the development server where the module id is a malicious data: URL containing arbitrary JavaScript. The import(id) call would then execute this code with Node.js privileges.
The patch mitigates this by introducing a validation mechanism. Before the dynamic import is executed, another import() is performed on a virtual module (virtual:vite-rsc/reference-validation?...). This triggers a new Vite plugin (rsc:reference-validation) that checks if the provided id is a legitimate and known server or client reference. If the id is not found in the list of valid references, the plugin throws an error, preventing the subsequent unsafe import and stopping the attack.
initialize.loadpackages/plugin-rsc/src/rsc.tsx
initialize.loadpackages/plugin-rsc/src/ssr.tsx