What is CVE-2025-67489?

CVE-2025-67489 is a critical-severity vulnerability in Vitejs Vite-plugin-react, classified under Code Injection. CVSS score: 9.8/10. Published 2025-12-09.

How severe is CVE-2025-67489?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Vitejs Vite-plugin-react

CVE-2025-67489

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadSer…

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.007 (48.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Vitejs Vite-plugin-react — versions < 0.5.6

Weakness classification (CWE)

CWE-94 — Code Injection

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-67489?: CVE-2025-67489 is a critical-severity vulnerability in Vitejs Vite-plugin-react, classified under Code Injection. CVSS score: 9.8/10. Published 2025-12-09.
How severe is CVE-2025-67489?: Critical severity. CVSS v3 base score is 9.8 out of 10.