Meltdown and Spectre are both microarchitectural timing attacks. Speculative and out-of-order-execution implementations of any instruction-set architecture are potentially vulnerable to this family of attack.
SiFive’s current RISC-V implementations do not perform the sort of speculation that these attacks rely upon, so they are not vulnerable. However, that is not to say that RISC-V is inherently invulnerable.