CVE-2025-57753 vite-plugin-static-copy files not included in `src` are accessible with a crafted request

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2...

CVE-2025-57753

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2...

@alexaegis/setup-editorconfig (>=0.0.1, <=0.0.5), @alexaegis/setup-workspace (>=0.0.1, <=0.0.5) +156 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=0.6.1, <=2.3.1)

vite-plugin-static-copy NPM version =0.6.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =16.5.0, =1.0.0-beta-v2.0.0, =0.4.3, =0.0.16, =1.0.4, =1.1.0, =0.0.1-rc-051923-9-a, =0.0.1-rc-050123-5, =0.0.1-rc-051823-5-c - @cqsjjb/scripts 3.0.0-vite.1 and more Source cves: CVE-2025-57753 Source advisory:...

@hpcc-js/esbuild-plugins (>=1.4.2, <=1.4.9), @yangzw/bruce-app (>=1.3.7, <=1.3.8) +1 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=3.0.0, <=3.1.1)

vite-plugin-static-copy NPM version =3.0.0, =1.4.2, =1.3.7, =1.3.8 - auto-reveal 0.7.0 Source cves: CVE-2025-57753 Source advisory: SNYK:JS-VITEPLUGINSTATICCOPY-12179280...

Directory Traversal

Overview vite-plugin-static-copy is a rollup-plugin-copy for vite with dev server support. Affected versions of this package are vulnerable to Directory Traversal via the viaLocal function. An attacker can access arbitrary files on the server by sending crafted HTTP requests that exploit path...

@alexaegis/setup-editorconfig (>=0.0.1, <=0.0.5), @alexaegis/setup-workspace (>=0.0.1, <=0.0.5) +156 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=0.6.1, <=2.3.1)

vite-plugin-static-copy NPM version =0.6.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =16.5.0, =1.0.0-beta-v2.0.0, =0.4.3, =0.0.16, =1.0.4, =1.1.0, =0.0.1-rc-051923-9-a, =0.0.1-rc-050123-5, =0.0.1-rc-051823-5-c - @cqsjjb/scripts 3.0.0-vite.1 and more Source cves: CVE-2025-57753 Source advisory:...

@hpcc-js/esbuild-plugins (>=1.4.2, <=1.4.9), @yangzw/bruce-app (>=1.3.7, <=1.3.8) +1 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=3.0.0, <=3.1.1)

vite-plugin-static-copy NPM version =3.0.0, =1.4.2, =1.3.7, =1.3.8 - auto-reveal 0.7.0 Source cves: CVE-2025-57753 Source advisory: OSV:GHSA-PP7P-Q8FX-2968...

CVE-2025-57753: Improper Limitation of a Pathname to a Restricted Directory

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2...