17 matches found
@doubao-apps/kit (>=0.0.18-canary-d3f0f27b-20260319141130, <=0.0.35), @ecom-mfe/rspack-config (>=1.0.1, <=1.0.2) +67 more potentially affected by CVE-2026-61782 via @rsdoctor/rspack-plugin (>=1.0.0-rc.0, <=1.5.13)
@rsdoctor/rspack-plugin NPM version =1.0.0-rc.0, =0.0.18-canary-d3f0f27b-20260319141130, =1.0.1, =3.7.0-beta.0, =0.1.0-next.21, =0.0.2-next.12, =0.0.2-next.12, =0.0.2-next.12, =3.0.0-0, =0.8.4, =0.8.4-canary-20250312-c1294cbe, =0.0.1, =0.0.2 and more Source cves: CVE-2026-61782 Source advisory:...
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
Summary The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS Access-Control-Allow-Origin: . Any network-adjacent or remote attacker can send a single...
GHSA-JMG2-RCXH-W8Q3 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
Summary The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS Access-Control-Allow-Origin: . Any network-adjacent or remote attacker can send a single...
@doubao-apps/kit (>=0.0.18-canary-d3f0f27b-20260319141130, <=0.0.35), @ecom-mfe/rspack-config (>=1.0.1, <=1.0.2) +67 more potentially affected by CVE-2026-61782 via @rsdoctor/rspack-plugin (>=1.0.0-rc.0, <=1.5.13)
@rsdoctor/rspack-plugin NPM version =1.0.0-rc.0, =0.0.18-canary-d3f0f27b-20260319141130, =1.0.1, =3.7.0-beta.0, =0.1.0-next.21, =0.0.2-next.12, =0.0.2-next.12, =0.0.2-next.12, =3.0.0-0, =0.8.4, =0.8.4-canary-20250312-c1294cbe, =0.0.1, =0.0.2 and more Source cves: CVE-2026-61782 Source advisory:...
CVE-2026-61782
Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...
CVE-2026-61782
Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by "@rsdoctor/rspack-plugin" binds to all network interfaces "0.0.0.0" and serves a "POST /api/data/key" endpoint with no authentication and wildcard CORS...
@atomicservice/ascf-toolkit (>=1.0.6, <=1.0.18-beta.1), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.18-beta.1) +78 more potentially affected by CVE-2026-61782 via @rsdoctor/utils (>=1.0.0-alpha.0, <=1.5.14)
@rsdoctor/utils NPM version =1.0.0-alpha.0, =1.0.6, =1.0.1-beta.1, =0.0.18-canary-d3f0f27b-20260319141130, =1.0.1, =3.7.0-beta.0, =0.1.0-next.21, =0.0.2-next.12, =0.0.2-next.12, =0.0.2-next.12, =3.0.0-0, =0.8.4, =0.14.2 and more Source cves: CVE-2026-61782 Source advisory: MEND:CVE-2026-61782...
CVE-2026-61782
The @rsdoctor/rspack-plugin (prior to version 1.5.16 ) contains an unauthenticated HTTP API that exposes sensitive build information. The default Rsdoctor report server binds to all network interfaces (0.0.0.0 ) and provides a POST /api/data/key endpoint with no authentication and wildcard CORS. ...
EUVD-2026-86323
Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...
CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...
CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...
@aumi/aumi (>=0.1.0, <=0.1.5), @aumi/bundler-rsbuild (>=0.1.0, <=0.1.5) +90 more potentially affected by CVE-2026-61782 via @rsdoctor/rspack-plugin (>=0.1.10, <=1.5.13)
@rsdoctor/rspack-plugin NPM version =0.1.10, =0.1.0, =0.1.0, =0.0.0-6105, =0.0.18-canary-d3f0f27b-20260319141130, =1.0.1, =3.1.0-rc.1, =0.15.1-beta.2, =0.1.0-next.21, =0.0.2-next.12, =0.1.2 and more Source cves: CVE-2026-61782 Source advisory: MEND:CVE-2026-61782...
@atomicservice/ascf-toolkit (>=1.0.6, <=1.0.18-beta.1), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.18-beta.1) +74 more potentially affected by CVE-2026-61782 via @rsdoctor/sdk (>=1.0.0-alpha.0, <=1.5.15)
@rsdoctor/sdk NPM version =1.0.0-alpha.0, =1.0.6, =1.0.1-beta.1, =0.0.18-canary-d3f0f27b-20260319141130, =1.0.1, =3.7.0-beta.0, =0.1.0-next.21, =0.0.2-next.12, =0.0.2-next.12, =0.0.2-next.12, =3.0.0-0, =0.8.4, =0.14.2 and more Source cves: CVE-2026-61782 Source advisory: MEND:CVE-2026-61782...
CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...
PT-2026-98195
Name of the Vulnerable Software and Affected Versions @rsdoctor/rspack-plugin versions prior to 1.5.16 Description The default report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint without authentication and with...
CVE-2026-61782: Exposure of Sensitive Information to an Unauthorized Actor
Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...
CVE-2026-61782
creationtimestamp| type| source ---|---|--- 2026-06-24 06:23:40+00:00| published-proof-of-concept| https://github.com/web-infra-dev/rsdoctor/security/advisories/GHSA-jmg2-rcxh-w8q3 2026-09-25 09:30:31+00:00| seen| https://gist.github.com/alon710/2ea4939fe39aae49f94968fc1d98881b...