Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

vite-plugin-static-copy

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.0npmAmendedPublished

    vite-plugin-static-copy files not included in src are possible to access with a crafted request

    CVE-2025-57753 · GHSA-pp7p-q8fx-2968

    Affected
    • npm vite-plugin-static-copy >= 3.0.0, <= 3.1.1; >= 0.4.3, <= 2.3.1
    Fixed in
    3.1.22.3.2· Vendor fix available
    Issue
    Files not included in src was possible to access with a crafted request. Impact Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Arbitrary files can be disclosed by exploiting this vulnerability. Details Consider the following configuration in used by vite.config.ts: The files under the ./public/images is only expected to be served. Abusing this vulnerability, an attacker can access arbitrary files on the filesystem. PoC I've attached a demo app to showcase the bug. Run it with npm run dev and issue the following HTTP request OR Observe that the /etc/passwd file is included in the response. <img width="1289" height="449" alt="Screenshot 2025-08-16 at 10 27 11 PM" src="https://github.com/user-attachments/assets/4de12612-7b86-44d7-a403-c76f12832e37" /

    Recommended action: Upgrade to 3.1.2 or 2.3.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →