PT-2022-24022

CVE-2022-37601

·

Published

2022-10-12

·

Updated

2026-09-02

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions loader-utils versions prior to 1.4.1 loader-utils versions prior to 2.0.3
Description The issue is related to a prototype pollution vulnerability in the parseQuery function within parseQuery.js in webpack loader-utils. This vulnerability is exploited via the name variable in parseQuery.js.
Recommendations For versions prior to 1.4.1, update to version 1.4.1 or later. For versions prior to 2.0.3, update to version 2.0.3 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
Related identifiers
CVE-2022-37601
GHSA-76P3-8JX3-JPFQ
AZL-26161
DLA-3258-1
RHSA-2023:6420
RHSA-2023:6972
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com