webpack.js vulnerabilities

Products

• loader-utils 3
• webpack 1
• webpack-dev-middleware 1
• webpack-dev-server 1

Latest webpack.js CVEs

Newest publication first

1. CVE-2024-29180 webpack-dev-middleware Path Traversal vulnerability

   Published 2024-03-21

   High·CVSS 7.4

   Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can eithe...

2. CVE-2023-28154 Cross-realm object access in Webpack 5

   Published 2023-03-13

   Critical·CVSS 9.8

   Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

3. CVE-2022-37603 loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable

   Published 2022-10-14

   High·CVSS 7.5

   A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

4. CVE-2022-37601 Prototype pollution in webpack loader-utils

   Published 2022-10-12

   Critical·CVSS 9.8

   Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

5. CVE-2022-37599 loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)

   Published 2022-10-11

   High·CVSS 7.5

   A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.

6. CVE-2018-14732 Missing Origin Validation in webpack-dev-server

   Published 2018-09-21

   High·CVSS 7.5 EPSS 2.5%

   An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.