Fix CVE–2022–37601

[debricked]

CVE–2022–37601

Vulnerability details

Description

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

NVD

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

GitHub

Prototype pollution in webpack loader-utils

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils prior to version 2.0.3 via the name variable in parseQuery.js.

CVSS details - 9.8

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

References

    [CVE-2022-37601]/Prototype pollution found in parseQuery.js · Issue #212 · webpack/loader-utils · GitHub
    loader-utils/parseQuery.js at d9f4e23cf411d8556f8bac2d3bf05a6e0103b568 · webpack/loader-utils · GitHub
    loader-utils/parseQuery.js at d9f4e23cf411d8556f8bac2d3bf05a6e0103b568 · webpack/loader-utils · GitHub
    Prototype pollution in webpack loader-utils · CVE-2022-37601 · GitHub Advisory Database · GitHub
    NVD - CVE-2022-37601
    Release v2.0.3 · webpack/loader-utils · GitHub
    fix: Resolve potential prototype polution exploit by JSMike · Pull Request #217 · webpack/loader-utils · GitHub
    fix: security problem by alexander-akait · Pull Request #220 · webpack/loader-utils · GitHub
    Release v1.4.1 · webpack/loader-utils · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE