cyfenced.com →

[ CVE-2026-61782 · Published 24 Sep 2026 ]

@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

CVSS 7.5 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interfaces (`0.0.0.0`) and serves a `POST /api/data/key` endpoint with no authentication and wildcard CORS (`Access-Control-Allow-Origin: *`). Any network-adjacent or remote attacker can send a single unauthenticated request to retrieve the full source code of all compiled JavaScript modules (`moduleCodeMap`), serialized build configuration (`configs`), error details, and other sensitive build metadata. This server is enabled by default in non-CI environments, requiring no special configuration from the victim developer. Version 1.5.16 patches the issue.

[ Fixes ]Fixes and patches

  • @rsdoctor/rspack-plugin 1.5.16Fixed version · GitHub Advisories · npm package @rsdoctor/rspack-plugin: upgrade to 1.5.16 or later (affected <= 1.5.15)

[ Packages ]Affected open-source packages

[ References ]References