webpack-dev-server up to 5.2.0 routine

Summaryinfo

A vulnerability was found in webpack-dev-server up to 5.2.0. It has been declared as problematic. This affects an unknown part. The manipulation results in routine. This vulnerability is identified as CVE-2025-30359. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in webpack-dev-server up to 5.2.0. Affected is some unknown processing. The manipulation with an unknown input leads to a routine vulnerability. CWE is classifying the issue as CWE-749. The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted. This is going to have an impact on confidentiality. CVE summarizes:

webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. Note that the attacker has to know the port and the output entrypoint script path. Combined with prototype pollution, the attacker can get a reference to the webpack runtime variables. By using `Function::toString` against the values in `__webpack_modules__`, the attacker can get the source code. Version 5.2.1 contains a patch for the issue.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-30359 since 03/21/2025. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 264715 (Linux Distros Unpatched Vulnerability : CVE-2025-30359), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.2.1 eliminates this vulnerability. Applying the patch d2575ad8dfed9207ed810b5ea0ccf465115a2239 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (264715). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• webpack-dev-server

Version

• 5.0
• 5.1
• 5.2.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion