GitHub Advisoryadvisory · npm

GHSA-76p3-8jx3-jpfq Prototype pollution in webpack loader-utils

CRITICAL Published 2022-10-13 Modified 2022-11-04 Official page ↗
Aliases
CVE-2022-37601
Ecosystem
npm
Packages
loader-utils
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2022-11-04

Affected packages

• npm loader-utils: >= 2.0.0, < 2.0.3 → fixed in 2.0.3 • npm loader-utils: < 1.4.1 → fixed in 1.4.1

Description

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils prior to version 2.0.3 via the name variable in parseQuery.js.

Related

Alias · CVE (1)

  • CVE-2022-37601 Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References