{"action":"Upgrade @rsdoctor/rspack-plugin to 1.5.16 or later.","affected":[{"fixed":"1.5.16","introduced":"0"}],"component":"@rsdoctor/rspack-plugin","cve_ids":["CVE-2026-61782"],"ecosystem":"npm","epss":0.0043,"exploited":false,"fixed_versions":["1.5.16"],"ghsa_id":"GHSA-jmg2-rcxh-w8q3","id":"tcs_01M5KFYDNAPC8H8NTX5NNTFKVZ","modified_at":"2026-09-24T20:00:05.116636767Z","published_at":"2026-09-24T19:42:10Z","references":["https://osv.dev/vulnerability/GHSA-jmg2-rcxh-w8q3","https://github.com/web-infra-dev/rsdoctor/security/advisories/GHSA-jmg2-rcxh-w8q3","https://nvd.nist.gov/vuln/detail/CVE-2026-61782","https://github.com/web-infra-dev/rsdoctor/pull/1744","https://github.com/web-infra-dev/rsdoctor/pull/1758","https://github.com/web-infra-dev/rsdoctor/commit/602eb306a49b6d19c4c1ea9d8ee0f8caab9e208f","https://github.com/web-infra-dev/rsdoctor/commit/e9aaef21f85becfe43a46f716509f41ea5edeb40","https://github.com/web-infra-dev/rsdoctor"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-jmg2-rcxh-w8q3","url":"https://osv.dev/vulnerability/GHSA-jmg2-rcxh-w8q3"}],"summary":"@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata"}