webpack

Records17All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

webpack records in CISA KEV

No webpack vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Webpack-dev-server 9 records MEDIUM Webpack 4 records MEDIUM Loader-utils 3 records HIGH Webpack-dev-middleware 1 record HIGH

Records

4 records in Webpack · all components

TI-2024-29382 CVE-2024-43788 · GHSA-4vvj-4cpr-p986

DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)

MEDIUM 62

Webpack is a module bundler.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00959 Published 2024-08-27 Partial fix · 5.94.0 CWE-79

TI-2023-12725 CVE-2023-28154 · GHSA-hc6q-2mpp-qw7j

Webpack 5 before 5.76.0 does not avoid cross-realm object access.

MEDIUM 52

Webpack 5 before 5.76.0 does not avoid cross-realm object access.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01409 Published 2023-03-13 Partial fix · 5.76.0

TI-2025-41991 CVE-2025-68458 · GHSA-8fgc-7cc6-rx7x

webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

MEDIUM 51

Webpack is a module bundler.

CVSS 3.1LOW 3.7 Network Low privileges User interaction EPSS 0.0023 Published 2026-02-05 Partial fix · 5.104.1 CWE-918

TI-2025-41737 CVE-2025-68157 · GHSA-38r7-794h-5758

webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects

MEDIUM 51

Webpack is a module bundler.

CVSS 3.1LOW 3.7 Network Low privileges User interaction EPSS 0.0023 Published 2026-02-05 Partial fix · 5.104.0 CWE-918

Open these records in search →