{"action":"Upgrade webpack to 5.94.0 or later.","affected":[{"fixed":"5.94.0","introduced":"5.0.0-alpha.0"}],"component":"webpack","cve_ids":["CVE-2024-43788"],"ecosystem":"npm","epss":0.00959,"exploited":false,"fixed_versions":["5.94.0"],"ghsa_id":"GHSA-4vvj-4cpr-p986","id":"tcs_01M5KF1M0NDD8Q9VJ9F85BJ74M","modified_at":"2026-09-10T03:50:18.076870007Z","published_at":"2024-08-27T19:50:40Z","references":["https://osv.dev/vulnerability/GHSA-4vvj-4cpr-p986","https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986","https://nvd.nist.gov/vuln/detail/CVE-2024-43788","https://github.com/webpack/webpack/issues/18718#issuecomment-2326296270","https://github.com/webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61","https://github.com/webpack/webpack","https://research.securitum.com/xss-in-amp4email-dom-clobbering","https://scnps.co/papers/sp23_domclob.pdf"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-4vvj-4cpr-p986","url":"https://osv.dev/vulnerability/GHSA-4vvj-4cpr-p986"}],"summary":"Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS"}