CVE-2025-67489 | vitejs vite-plugin-react up to 0.5.5 loadserverAction/decodeReply/decodeAction code injection (GHSA-j76j-5p5g-9wfr)

A vulnerability was found in vitejs vite-plugin-react up to 0.5.5. It has been classified as critical. This issue affects the function loadserverAction/decodeReply/decodeAction. This manipulation causes code injection.

This vulnerability is registered as CVE-2025-67489. Remote exploitation of the attack is possible. No exploit is available.

Upgrading the affected component is recommended.