The vulnerability exists because the Rsdoctor report HTTP server, started by the @rsdoctor/rspack-plugin, listens on all network interfaces and exposes a POST /api/data/key endpoint without authentication or restrictions. The endpoint returns the full source code of built JavaScript modules, build configuration, error details, and other sensitive metadata. This constitutes an information‑disclosure flaw (CWE‑200) that allows an attacker to retrieve confidential project information. The likely attack vector is any network‑adjacent or remote attacker who can reach the host, as no authentication is required.

Affected systems are projects that use the Rsdoctor plugin prior to version 1.5.16 in environments where the plugin is enabled by default, such as local developer machines or non‑CI server installations. The plugin is distributed by the web‑infra‑dev vendor; any installation of the @rsdoctor/rspack-plugin before 1.5.16 is vulnerable.

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the HTTP server binds to 0.0.0.0, an attacker with network access—whether local or over the internet—can exploit the unauthenticated endpoint, making the flaw potentially exploitable from anywhere that can reach the target host. No special configurations are required to launch the attack; the vulnerable behavior is enabled by default in non‑CI contexts.