chore(deps): update dependency vite-plugin-static-copy to v3.1.2 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vite-plugin-static-copy	3.0.0 → 3.1.2

GitHub Vulnerability Alerts

CVE-2025-57753

Summary

Files not included in src was possible to access with a crafted request.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Arbitrary files can be disclosed by exploiting this vulnerability.

Details

Consider the following configuration in used by vite.config.ts:

import { defineConfig } from 'vite'
import { viteStaticCopy } from 'vite-plugin-static-copy'

export default defineConfig({
    plugins: [
      viteStaticCopy({
        targets: [
          {
            src: "./public/images",
            dest: "./",
          },
        ],
      }),
    ],
  });

The files under the ./public/images is only expected to be served. Abusing this vulnerability, an attacker can access arbitrary files on the filesystem.

PoC

I've attached a demo app to showcase the bug.

Run it with npm run dev and issue the following HTTP request

GET /static/images/../../../../../../../etc/passwd HTTP/1.1
Host: localhost:3001
Content-Length: 2

OR

curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: localhost:3001' -H $'Content-Length: 2' \
    --data-binary $'\x0d\x0a' \
    $'http://localhost:3001/static/images/../../../../../../../etc/passwd'

Observe that the /etc/passwd file is included in the response.

Severity

• CVSS Score: 6.0 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

---

Release Notes

sapphi-red/vite-plugin-static-copy (vite-plugin-static-copy)

v3.1.2

Compare Source

Patch Changes

• #​195 0bc6b49 Thanks @​sapphi-red! - Files not included in src was possible to acess with a crafted request. See GHSA-pp7p-q8fx-2968 for more details.

v3.1.1

Compare Source

Patch Changes

• #​186 fc84156 Thanks @​sapphi-red! - fix a bug that the content was not sent when multiple vite-plugin-static-copy instance was used

v3.1.0

Compare Source

Minor Changes

• #​171 9c7cf2e Thanks @​MrRefactoring! - add Vite 7 to peer dep range

v3.0.2

Compare Source

Patch Changes

• #​167 89458b2 Thanks @​sapphi-red! - improved file grouping algorithm for better performance

v3.0.1

Compare Source

Patch Changes

• #​166 60409c5 Thanks @​sapphi-red! - fix absolute destination paths in copy targets incorrectly returning contents in dev

• #​164 337f976 Thanks @​sapphi-red! - fixes case-insensitive path conflicts causing copy failures (EEXIST error)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

❌ Deploy Preview for kleros-v2-neo failed. Why did it fail? →

Name	Link
🔨 Latest commit	d48d83c
🔍 Latest deploy log	https://app.netlify.com/projects/kleros-v2-neo/deploys/69d937ef64ab4d00086a5950

[netlify]

❌ Deploy Preview for kleros-v2-university failed. Why did it fail? →

Name	Link
🔨 Latest commit	01a38f6
🔍 Latest deploy log	https://app.netlify.com/projects/kleros-v2-university/deploys/68c9a433fa4a780008fe97a2

[netlify]

✅ Deploy Preview for kleros-v2-testnet ready!

Name	Link
🔨 Latest commit	d48d83c
🔍 Latest deploy log	https://app.netlify.com/projects/kleros-v2-testnet/deploys/69d937efa526b40008f2e87b
😎 Deploy Preview	https://deploy-preview-2101--kleros-v2-testnet.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (1)

• chore(deps):

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[netlify]

❌ Deploy Preview for kleros-v2-testnet-devtools failed. Why did it fail? →

Name	Link
🔨 Latest commit	d48d83c
🔍 Latest deploy log	https://app.netlify.com/projects/kleros-v2-testnet-devtools/deploys/69d937ef0b4ead0008936696

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud