CVE-2025-30359

Katalog CVE

CVSS 5.9 · Medium EPSS 0,57%

Kerentanan Exposed Dangerous Method or Function pada webpack.js webpack-dev-server. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. Note that the attacker has to know the port and the output entrypoint script path. Combined with prototype pollution, the attacker can get a reference to the webpack runtime variables. By using `Function::toString` against the values in `__webpack_modules__`, the attacker can get the source code. Version 5.2.1 contains a patch for the issue.

Rincian

Terbit di NVD

3 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-749: Exposed Dangerous Method or Function

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v exploit · advisory vendor
• https://github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239 patch