CVE-2025-57753

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-57753
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57753.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-57753
Aliases
Published
2025-08-21T16:03:04.804Z
Modified
2025-12-05T10:20:20.552713Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
vite-plugin-static-copy files not included in `src` are accessible with a crafted request
Details

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57753.json",
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/sapphi-red/vite-plugin-static-copy

Affected ranges

Type
GIT
Repo
https://github.com/sapphi-red/vite-plugin-static-copy
Events
Introduced
a20331b452c1498eca27c462badba62c3179c1a4
Fixed
edab809c0188ed66787b8f20ca8d2a2c394a500d
Database specific 
{
    "versions": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.1.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/sapphi-red/vite-plugin-static-copy
Events
Introduced
59b0fe6d5074f645466aac23c5bbe3c080aaa7c6
Fixed
326a79fb29bd082a876f59681d2d61e488267331
Database specific 
{
    "versions": [
        {
            "introduced": "0.4.3"
        },
        {
            "fixed": "2.3.2"
        }
    ]
}

Affected versions

v0.*

v0.10.0
v0.11.0
v0.11.1
v0.12.0
v0.13.0
v0.13.1
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.17.1
v0.4.3
v0.4.4
v0.5.0
v0.5.1
v0.6.0
v0.6.1
v0.7.0
v0.8.0
v0.9.0

vite-plugin-static-copy@1.*

vite-plugin-static-copy@1.0.0
vite-plugin-static-copy@1.0.1
vite-plugin-static-copy@1.0.2
vite-plugin-static-copy@1.0.3
vite-plugin-static-copy@1.0.4
vite-plugin-static-copy@1.0.5
vite-plugin-static-copy@1.0.6

vite-plugin-static-copy@2.*

vite-plugin-static-copy@2.0.0
vite-plugin-static-copy@2.1.0
vite-plugin-static-copy@2.2.0
vite-plugin-static-copy@2.3.0
vite-plugin-static-copy@2.3.1

vite-plugin-static-copy@3.*

vite-plugin-static-copy@3.0.0
vite-plugin-static-copy@3.0.1
vite-plugin-static-copy@3.0.2
vite-plugin-static-copy@3.1.0
vite-plugin-static-copy@3.1.1