{"action":"Upgrade vite-plugin-static-copy to 2.3.2 or later.","affected":[{"fixed":"3.1.2","introduced":"3.0.0"},{"fixed":"2.3.2","introduced":"0.4.3"}],"component":"vite-plugin-static-copy","cve_ids":["CVE-2025-57753"],"ecosystem":"npm","epss":0.00422,"exploited":false,"fixed_versions":["3.1.2","2.3.2"],"ghsa_id":"GHSA-pp7p-q8fx-2968","id":"tcs_01M5KG44G9HJ9XMMXQQ9G9TB5W","modified_at":"2025-08-21T19:16:58Z","published_at":"2025-08-21T14:53:52Z","references":["https://osv.dev/vulnerability/GHSA-pp7p-q8fx-2968","https://github.com/sapphi-red/vite-plugin-static-copy/security/advisories/GHSA-pp7p-q8fx-2968","https://nvd.nist.gov/vuln/detail/CVE-2025-57753","https://github.com/sapphi-red/vite-plugin-static-copy/commit/0bc6b49ed72b46eecfc9682045f4b46a19694969","https://github.com/sapphi-red/vite-plugin-static-copy/commit/4627afb8582083eab733881d3d974e1c1f23997d","https://github.com/sapphi-red/vite-plugin-static-copy","https://github.com/sapphi-red/vite-plugin-static-copy/releases/tag/vite-plugin-static-copy%402.3.2","https://github.com/sapphi-red/vite-plugin-static-copy/releases/tag/vite-plugin-static-copy%403.1.2"],"severity":{"label":"medium","score":6},"sources":[{"source":"osv","source_id":"GHSA-pp7p-q8fx-2968","url":"https://osv.dev/vulnerability/GHSA-pp7p-q8fx-2968"},{"source":"nvd","source_id":"CVE-2025-57753","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57753"}],"summary":"vite-plugin-static-copy files not included in `src` are possible to access with a crafted request"}