chore(deps): update dependency vite-plugin-static-copy to v2 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vite-plugin-static-copy	1.0.4 → 2.3.2

GitHub Vulnerability Alerts

CVE-2025-57753

Summary

Files not included in src was possible to access with a crafted request.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Arbitrary files can be disclosed by exploiting this vulnerability.

Details

Consider the following configuration in used by vite.config.ts:

import { defineConfig } from 'vite'
import { viteStaticCopy } from 'vite-plugin-static-copy'

export default defineConfig({
    plugins: [
      viteStaticCopy({
        targets: [
          {
            src: "./public/images",
            dest: "./",
          },
        ],
      }),
    ],
  });

The files under the ./public/images is only expected to be served. Abusing this vulnerability, an attacker can access arbitrary files on the filesystem.

PoC

I've attached a demo app to showcase the bug.

Run it with npm run dev and issue the following HTTP request

GET /static/images/../../../../../../../etc/passwd HTTP/1.1
Host: localhost:3001
Content-Length: 2

OR

curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: localhost:3001' -H $'Content-Length: 2' \
    --data-binary $'\x0d\x0a' \
    $'http://localhost:3001/static/images/../../../../../../../etc/passwd'

Observe that the /etc/passwd file is included in the response.

---

Release Notes

sapphi-red/vite-plugin-static-copy (vite-plugin-static-copy)

v2.3.2

Compare Source

Patch Changes

• 4627afb Thanks @​sapphi-red! - Files not included in src was possible to acess with a crafted request. See GHSA-pp7p-q8fx-2968 for more details.

v2.3.1

Compare Source

Patch Changes

• #​152 6aee6a3 Thanks @​sapphi-red! - improve performance of internal isSubdirectoryOrEqual function

v2.3.0

Compare Source

Minor Changes

• 281f5b2 Thanks @​sapphi-red! - improve performance by coping files concurrently when possible

Patch Changes

• #​149 a9f35c9 Thanks @​sapphi-red! - ensure .[cm]?[tj]sx? static assets are JS mime to align with Vite. vitejs/vite#19453

v2.2.0

Compare Source

Minor Changes

• #​141 88e513d Thanks @​sapphi-red! - add Vite 6 to peer dep

v2.1.0

Compare Source

Minor Changes

• #​133 b9c09bd Thanks @​rschristian! - Allows user to optionally configure when the plugin is ran by passing in a Rollup hook name

v2.0.0

Compare Source

Major Changes

• #​127 21304df Thanks @​tassioFront! - feat: throw an error when does not find file

v1.0.6

Compare Source

Patch Changes

• #​121 d68aec9 Thanks @​tobz1000! - The value of Content-Type header was inferred and set from the src file extension. It is now infered from the dest file extension.

v1.0.5

Compare Source

Patch Changes

• 311ce4d Thanks @​sapphi-red! - generate provenance statements for the package

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Preview: https://2458--pr-cinny.netlify.app
⚠️ Exercise caution. Use test accounts. ⚠️