Executive brief
webpack loader-utils is a utility library widely used in JavaScript build processes to parse and manipulate query strings. A prototype pollution vulnerability in the parseQuery function allows an attacker to inject malicious properties into JavaScript objects, potentially compromising application logic, enabling arbitrary code execution, or causing a complete service outage. This affects build pipelines and any application that processes untrusted query parameters.
Technical details
A prototype pollution vulnerability exists in the parseQuery function in parseQuery.js in webpack loader-utils prior to version 2.0.3 (and versions prior to 1.4.1). The vulnerability is triggered via the name variable during parsing of query strings. An attacker can craft malicious query strings containing prototype-chain payloads (e.g., using __proto__ or constructor.prototype) to pollute the JavaScript Object prototype. No authentication or user interaction is required; the vulnerability is triggered when the library processes untrusted input. Successful exploitation allows an attacker to modify prototype properties, affecting all subsequently created objects and potentially leading to remote code execution or denial of service. Patches are available in versions 2.0.3 and 1.4.1.
Affected products
- webpack loader-utils 0.x through 1.4.0, 2.0.0 through 2.0.2
Timeline
- 2022-10-13: disclosed
- 2022-10-13: patched: Versions 1.4.1 and 2.0.3 released with fix