Unauthenticated HTTP API in @rsdoctor/rspack-plugin Exposes Source Code and Build Metadata

What happened

Prior to version 1.5.16, the Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin bound to all network interfaces (0.0.0.0) by default. It served a POST /api/data/key endpoint without any authentication and with a wildcard CORS policy (Access-Control-Allow-Origin: *). As a result, any network-adjacent or remote attacker could send a single unauthenticated request to this endpoint to retrieve the full source code of all compiled JavaScript modules (moduleCodeMap), the serialized build configuration (configs), error details, and other sensitive build metadata.

Technical cause

The root cause is twofold: the server listens on 0.0.0.0, making it reachable beyond the local machine, and the data-retrieval endpoint lacks authentication while also permitting cross-origin requests from any origin due to the wildcard CORS header. Combined, these weaknesses allow unauthorized actors to pull sensitive build data without needing to be on the same host or to present any credentials. This is classified as CWE-200, Exposure of Sensitive Information to an Unauthorized Actor.

Why it matters

The exposed data includes the complete source code of compiled JavaScript modules and build configuration details. Depending on the project, this could reveal proprietary application logic, internal architecture, or configuration values that were not intended to be publicly accessible. Because the report server is enabled by default in non-CI environments and requires no special configuration to trigger exposure, developers may be affected without realizing the server was reachable externally.

Who is affected

Any project using @rsdoctor/rspack-plugin in a version up to and including 1.5.15, where the default Rsdoctor report server is active in a non-CI environment, is potentially affected. Exposure depends on whether the host running the build process is reachable from untrusted networks.

Affected versions

@rsdoctor/rspack-plugin versions up to and including 1.5.15 are affected. Version 1.5.16 contains the fix.

Fixes and mitigation

The vendor has released version 1.5.16 of @rsdoctor/rspack-plugin, which patches the unauthenticated endpoint and the default network binding behavior described above.

Recommended action

Upgrade @rsdoctor/rspack-plugin to version 1.5.16 or later. Until the upgrade is applied, avoid running the Rsdoctor report server on hosts reachable from untrusted networks, and restrict network access to the build host where possible.