rsdoctor

CVE-2026-61782: CVE-2026-61782: Sensitive Information Disclosure and Source Code Exfiltration via Insecure HTTP Server… CVE-2026-61782: Sensitive Information Disclosure and Source Code Exfiltration via Insecure HTTP Server Defaults in @rsdoctor/rspack-plugin > Vulnerability ID: CVE-2026-61782 > CVSS Score: 7.5 > Published: 2026-09-24 An insecure configuration in the diagnostic HTTP server of @rsdoctor/rspack-plugin allowed unauthenticated remote attackers or malicious local websites to retrieve serialized build metadata and full source code modules. TL;DR An insecure default binding (0.0.0.0) combined with wildcard CORS headers in the @rsdoctor/rspack-plugin allowed unauthorized source code retrieval via cross-origin or local network requests. --- ⚠️ Exploit Status: POC Technical Details - CWE ID: CWE-200 - Attack Vector: Network (AV:N) - CVSS v3.1 Score: 7.5 (High) - Exploit Status: Proof of Concept - Impact: Confidentiality: High - CISA KEV Status: Not Listed Affected Systems - @rsdoctor/rspack-plugin prior to 1.5.16 - @rsdoctor/rspack-plugin: < 1.5.16 (Fixed in: 1.5.16) Code Analysis Commit: 602eb30 fix: restrict server host binding to 127.0.0.1 and implement safe origins Commit: e9aaef2 fix: secure local websocket validation using randomized handshake tokens Mitigation Strategies - Upgrade @rsdoctor/rspack-plugin to version 1.5.16 or higher - Run builds with CI=true environment variable to suppress diagnostic server creation - Configure firewall rules to block unsolicited incoming traffic on workstation development ports Remediation Steps: 1. Verify currently installed version of @rsdoctor/rspack-plugin in package.json or lockfile 2. Execute dependency upgrade command: pnpm add -D @rsdoctor/rspack-plugin@1.5.16 or npm install --save-dev @rsdoctor/rspack-plugin@1.5.16 3. Verify host binding of the diagnostic server is restricted to 127.0.0.1 4. Ensure Host header and CORS origin validation are active in local configuration References - GitHub Security Advisory GHSA-jmg2-rcxh-w8q3 - CVE-2026-61782 CVE Record --- Read the full report for CVE-2026-61782 on our website for more details including interactive diagrams and full exploit analysis.