Describe the issue

While working on the Stylex project, I uploaded the package files to Vulert for a dependency scan. The scan flagged a critical RCE vulnerability CVE-2025-67489 affecting @vitejs/plugin-rsc.
The issue is caused by unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction), allowing attackers with network access to execute arbitrary JavaScript code on the Node.js server.

CVE Report
CVE Link

Expected behavior

The package should not ship with vulnerable server APIs that allow RCE.

Steps to reproduce

Upload the project’s package.json and lock file to Vulert.
Run a vulnerability scan.
Observe that Vulert reports CVE-2025-67489 for @vitejs/plugin-rsc, indicating an RCE risk caused by unsafe dynamic imports.

Test case

No response

Additional comments

No response