Skip to content
CVE PROGRAM SOURCE RECORD6.0 Medium

CVE-2025-57753

vite-plugin-static-copy files not included in `src` are accessible with a crafted request

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

sapphi-red vite-plugin-static-copy

  • >= 3.0.0, < 3.1.2affected
  • >= 0.4.3, < 2.3.2affected

References