{"action":"Upgrade loader-utils to 1.4.2 or later.","affected":[{"fixed":"1.4.2","introduced":"1.0.0"},{"fixed":"2.0.4","introduced":"2.0.0"},{"fixed":"3.2.1","introduced":"3.0.0"}],"component":"loader-utils","cve_ids":["CVE-2022-37603"],"ecosystem":"npm","epss":0.02702,"exploited":false,"fixed_versions":["1.4.2","2.0.4","3.2.1"],"ghsa_id":"GHSA-3rfm-jhwj-7488","id":"tcs_01M5KEY5PSHX50BR4HT2X4NQ3A","modified_at":"2023-11-08T04:10:09.241945Z","published_at":"2022-10-14T19:00:38Z","references":["https://osv.dev/vulnerability/GHSA-3rfm-jhwj-7488","https://nvd.nist.gov/vuln/detail/CVE-2022-37603","https://github.com/webpack/loader-utils/issues/213","https://github.com/webpack/loader-utils/issues/216","https://github.com/webpack/loader-utils/commit/17cbf8fa8989c1cb45bdd2997aa524729475f1fa","https://github.com/webpack/loader-utils/commit/ac09944dfacd7c4497ef692894b09e63e09a5eeb","https://github.com/webpack/loader-utils/commit/d2d752d59629daee38f34b24307221349c490eb1","https://github.com/webpack/loader-utils","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-3rfm-jhwj-7488","url":"https://osv.dev/vulnerability/GHSA-3rfm-jhwj-7488"}],"summary":"loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable"}