Packages / loader-utils / Security

CriticalVulnerabilityGHSA-76p3-8jx3-jpfqCVE-2022-37601Published 13 Oct 2022

Prototype pollution in webpack loader-utils

Affected releases · loader-utils

  • 2.x2.0.0 – 2.0.2Fixed in 2.0.3
  • 1.x1.0.0 – 1.4.0Fixed in 1.4.1
  • 0.2.x and older0.1.0 – 0.2.17No fix, no longer updated

On 2.x, the newest line:

npm install loader-utils@2.0.3
3.x

  1. Not affected

    3.0.0 – 3.3.1

    10 releases, latest

2.x

  1. Affected

    2.0.0 – 2.0.2

    3 releases

  2. Fixed

    2.0.3 – 2.0.4

    2 releases

1.x

  1. Affected

    1.0.0 – 1.4.0

    12 releases

  2. Fixed

    1.4.1 – 1.4.2

    2 releases

0.x

  1. Affected

    0.1.0 – 0.2.17

    21 releases

50 stable releases of loader-utils, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for loader-utils. It is read in your browser and sent nowhere.

What happens

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils prior to version 2.0.3 via the name variable in parseQuery.js.