CVE-2022-37601

Description

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Reserved 2022-08-08 | Published 2022-10-12 | Updated 2024-10-28 | Assigner mitre

References

github.com/...d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js

github.com/...d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js

github.com/webpack/loader-utils/issues/212

github.com/webpack/loader-utils/issues/212

dl.acm.org/doi/abs/10.1145/3488932.3497769

dl.acm.org/doi/pdf/10.1145/3488932.3497769

users.encs.concordia.ca/.../JS-vulnerability-aisaccs2022.pdf

github.com/xmldom/xmldom/issues/436

lists.debian.org/debian-lts-announce/2022/12/msg00044.html ([debian-lts-announce] 20221231 [SECURITY] [DLA 3258-1] node-loader-utils security update) mailing-list

cve.org (CVE-2022-37601)

nvd.nist.gov (CVE-2022-37601)

Download JSON