CVE-2018-14732

Name of the Vulnerable Software and Affected Versions webpack-dev-server versions prior to 3.1.10 webpack-dev-server versions prior to 3.1.6

Description An issue in the WebSocket server used for Hot Module Replacement (HMR) allows attackers to steal a developer's source code because the origin of requests is not validated. This enables a remote attacker to receive HMR messages sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.

Recommendations For versions prior to 3.1.6, update to version 3.1.11 or later. For versions prior to 3.1.10, update to version 3.1.11 or later.