CVE-2024-43788
1 advisory.
npm/webpack CVE-2024-43788: medium 6.4, EPSS 0.96%
Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS
Action: Upgrade webpack to 5.94.0 or later.
npm i webpack@5.94.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0-alpha.0 | 5.94.0 | - |
Fixed versions
| 5.94.0 |
Sources
- osv: GHSA-4vvj-4cpr-p986
- https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986
- https://nvd.nist.gov/vuln/detail/CVE-2024-43788
- https://github.com/webpack/webpack/issues/18718#issuecomment-2326296270
- https://github.com/webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61
- https://github.com/webpack/webpack
- https://research.securitum.com/xss-in-amp4email-dom-clobbering
- https://scnps.co/papers/sp23_domclob.pdf
CVE-2024-43788 · published · modified · JSON