CVE-2026-61782: Sensitive Information Disclosure and Source Code Exfiltration via Insecure HTTP Server Defaults in @rsdoctor/rspack-plugin
Vulnerability ID: CVE-2026-61782
CVSS Score: 7.5
Published: 2026-09-24
An insecure configuration in the diagnostic HTTP server of @rsdoctor/rspack-plugin allowed unauthenticated remote attackers or malicious local websites to retrieve serialized build metadata and full source code modules.
TL;DR
An insecure default binding (0.0.0.0) combined with wildcard CORS headers in the @rsdoctor/rspack-plugin allowed unauthorized source code retrieval via cross-origin or local network requests.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-200
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 7.5 (High)
- Exploit Status: Proof of Concept
- Impact: Confidentiality: High
- CISA KEV Status: Not Listed
Affected Systems
- @rsdoctor/rspack-plugin prior to 1.5.16
-
@rsdoctor/rspack-plugin: < 1.5.16 (Fixed in:
1.5.16)
Code Analysis
Commit: 602eb30
fix: restrict server host binding to 127.0.0.1 and implement safe origins
Commit: e9aaef2
fix: secure local websocket validation using randomized handshake tokens
Mitigation Strategies
- Upgrade @rsdoctor/rspack-plugin to version 1.5.16 or higher
- Run builds with CI=true environment variable to suppress diagnostic server creation
- Configure firewall rules to block unsolicited incoming traffic on workstation development ports
Remediation Steps:
- Verify currently installed version of @rsdoctor/rspack-plugin in package.json or lockfile
- Execute dependency upgrade command: pnpm add -D @rsdoctor/rspack-plugin@1.5.16 or npm install --save-dev @rsdoctor/rspack-plugin@1.5.16
- Verify host binding of the diagnostic server is restricted to 127.0.0.1
- Ensure Host header and CORS origin validation are active in local configuration
References
Read the full report for CVE-2026-61782 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)