Home

Description

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2.

PUBLISHED Reserved 2025-08-19 | Published 2025-08-21 | Updated 2025-08-21 | Assigner GitHub_M




MEDIUM: 6.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

>= 3.0.0, < 3.1.2
affected

>= 0.4.3, < 2.3.2
affected

References

github.com/...c-copy/security/advisories/GHSA-pp7p-q8fx-2968

cve.org (CVE-2025-57753)

nvd.nist.gov (CVE-2025-57753)

Download JSON