Webpack
Monthly
Path traversal in webpack-dev-middleware bypasses the incomplete CVE-2024-29180 fix by embedding dot-dot sequences within path segments (e.g., 'assets..') rather than as standalone segments, causing the UP_PATH_REGEXP guard to pass while the subsequent fixed-offset slice produces a parent-directory component that resolves above outputPath on the physical filesystem. Affected versions are precisely 5.3.4+, 6.1.2+, and 7.1.0+ - the releases that introduced the original guard-and-slice logic intended to fix path traversal. Exploitation is constrained to non-default configurations where publicPath lacks a trailing slash and the physical filesystem is in use via writeToDisk: true or a custom outputFileSystem; no public exploit identified at time of analysis, though a functional PoC for the predecessor attack class exists in GHSA-wr3j-pwj9-hqq6.
Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). [CVSS 3.7 LOW]
Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. [CVSS 3.7 LOW]
Webpack is a module bundler. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Webpack 5 before 5.76.0 does not avoid cross-realm object access. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Path traversal in webpack-dev-middleware bypasses the incomplete CVE-2024-29180 fix by embedding dot-dot sequences within path segments (e.g., 'assets..') rather than as standalone segments, causing the UP_PATH_REGEXP guard to pass while the subsequent fixed-offset slice produces a parent-directory component that resolves above outputPath on the physical filesystem. Affected versions are precisely 5.3.4+, 6.1.2+, and 7.1.0+ - the releases that introduced the original guard-and-slice logic intended to fix path traversal. Exploitation is constrained to non-default configurations where publicPath lacks a trailing slash and the physical filesystem is in use via writeToDisk: true or a custom outputFileSystem; no public exploit identified at time of analysis, though a functional PoC for the predecessor attack class exists in GHSA-wr3j-pwj9-hqq6.
Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). [CVSS 3.7 LOW]
Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. [CVSS 3.7 LOW]
Webpack is a module bundler. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Webpack 5 before 5.76.0 does not avoid cross-realm object access. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.