Malicious code in vite-ts-icon (npm)

The package vite-ts-icon was found to contain malicious code...

MAL-2025-42110 Malicious code in vite-mobcss-log (npm)

The package vite-mobcss-log was found to contain malicious code...

MAL-2025-42111 Malicious code in vite-ts-icon (npm)

The package vite-ts-icon was found to contain malicious code...

Malicious code in vite-mobcss-log (npm)

The package vite-mobcss-log was found to contain malicious code...

MAL-2025-42112 Malicious code in vite-tsconfig-optimized (npm)

The package vite-tsconfig-optimized was found to contain malicious code...

Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant IDE Extensions

Summary Multiple vulnerabilities were addressed in IBM watsonx Code Assistant IDE Extensions VS code - V1.8.2, Eclipse IDE - 1.4.1 Vulnerability Details CVEID:CVE-2025-31125 DESCRIPTION: Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using...

Malicious code in vite-binding-js (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-41613 Malicious code in vite-binding-js (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-57753

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2...

CVE-2025-57753 vite-plugin-static-copy files not included in `src` are accessible with a crafted request

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2...

CVE-2025-57753 vite-plugin-static-copy files not included in `src` are accessible with a crafted request

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2...

CVE-2025-57753

The CVE-2025-57753 vulnerability affects vite-plugin-static-copy (a Rollup plugin for Vite). Affected versions allow a crafted HTTP request to access files not included in src when the Vite dev server is exposed to the network. Impact is information disclosure of files outside the intended direct...

CVE-2025-57753 vite-plugin-static-copy files not included in `src` are accessible with a crafted request

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2...

@hpcc-js/esbuild-plugins (>=1.4.2, <=1.4.9), @yangzw/bruce-app (>=1.3.7, <=1.3.8) +1 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=3.0.0, <=3.1.1)

vite-plugin-static-copy NPM version =3.0.0, =1.4.2, =1.3.7, =1.3.8 - auto-reveal 0.7.0 Source cves: CVE-2025-57753 Source advisory: OSV:GHSA-PP7P-Q8FX-2968...

@hpcc-js/esbuild-plugins (>=1.4.2, <=1.4.9), @yangzw/bruce-app (>=1.3.7, <=1.3.8) +1 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=3.0.0, <=3.1.1)

vite-plugin-static-copy NPM version =3.0.0, =1.4.2, =1.3.7, =1.3.8 - auto-reveal 0.7.0 Source cves: CVE-2025-57753 Source advisory: SNYK:JS-VITEPLUGINSTATICCOPY-12179280...

GHSA-PP7P-Q8FX-2968 vite-plugin-static-copy files not included in `src` are possible to access with a crafted request

Summary Files not included in src was possible to access with a crafted request. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Arbitrary files can be disclosed by exploiting this vulnerability. Details Consider the...

Directory Traversal

Overview vite-plugin-static-copy is a rollup-plugin-copy for vite with dev server support. Affected versions of this package are vulnerable to Directory Traversal via the viaLocal function. An attacker can access arbitrary files on the server by sending crafted HTTP requests that exploit path...

@alexaegis/setup-editorconfig (>=0.0.1, <=0.0.5), @alexaegis/setup-workspace (>=0.0.1, <=0.0.5) +155 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=0.6.1, <=2.3.1)

vite-plugin-static-copy NPM version =0.6.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =16.5.0, =1.0.0-beta-v2.0.0, =0.4.3, =0.0.16, =1.0.4, =1.1.0, =0.0.1-rc-051923-9-a, =0.0.1-rc-050123-5, =0.0.1-rc-051823-5-c - @cqsjjb/scripts 3.0.0-vite.1 and more Source cves: CVE-2025-57753 Source advisory:...

vite-plugin-static-copy files not included in `src` are possible to access with a crafted request

Summary Files not included in src was possible to access with a crafted request. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Arbitrary files can be disclosed by exploiting this vulnerability. Details Consider the...

@alexaegis/setup-editorconfig (>=0.0.1, <=0.0.5), @alexaegis/setup-workspace (>=0.0.1, <=0.0.5) +155 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=0.6.1, <=2.3.1)

vite-plugin-static-copy NPM version =0.6.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =16.5.0, =1.0.0-beta-v2.0.0, =0.4.3, =0.0.16, =1.0.4, =1.1.0, =0.0.1-rc-051923-9-a, =0.0.1-rc-050123-5, =0.0.1-rc-051823-5-c - @cqsjjb/scripts 3.0.0-vite.1 and more Source cves: CVE-2025-57753 Source advisory:...