CVE-2026-61782: Sensitive Information Disclosure and Source Code Exfiltration via Insecure HTTP Server Defaults in @rsdoctor/rspack-plugin

Vulnerability ID: CVE-2026-61782

CVSS Score: 7.5

Published: 2026-09-24

An insecure configuration in the diagnostic HTTP server of @rsdoctor/rspack-plugin allowed unauthenticated remote attackers or malicious local websites to retrieve serialized build metadata and full source code modules.

TL;DR

An insecure default binding (0.0.0.0) combined with wildcard CORS headers in the @rsdoctor/rspack-plugin allowed unauthorized source code retrieval via cross-origin or local network requests.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-200

Attack Vector : Network (AV:N)

CVSS v3.1 Score : 7.5 (High)

Exploit Status : Proof of Concept

Impact : Confidentiality: High

CISA KEV Status : Not Listed

Affected Systems

@rsdoctor/rspack-plugin prior to 1.5.16

@rsdoctor/rspack-plugin : < 1.5.16 (Fixed in: 1.5.16 )

Code Analysis

Commit: 602eb30

fix: restrict server…