# CVE-2024-43788: Webpack AutoPublicPathRuntimeModule DOM Clobbering XSS

Source: https://junglewise.ai/threats/cve-2024-43788-webpack-autopublicpathruntimemodule-dom-clobbering-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-43788 · Severity: low · CVSS 3.1 · Published 2024-08-27

Webpack is a popular JavaScript bundler used by millions of web applications. When developers configure Webpack with automatic public path resolution, the generated code can be tricked into loading JavaScript from attacker-controlled servers if an attacker can inject HTML tags with specific attributes. This vulnerability allows cross-site scripting (XSS) attacks on websites that permit users to add HTML (e.g., markdown renderers, forums, web-based email) and has been exploited in real-world applications like Canvas LMS.

Technologies: [webpack (npm)](https://junglewise.ai/threats/technologies/webpack). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-43788 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-43788 being exploited in the wild.

**How severe is CVE-2024-43788?** Low severity, with a CVSS score of 3.1, published 27 August 2024.

**Which products and versions are affected?** webpack (npm) SEMVER:introduced=5.0.0-alpha.0,fixed=5.94.0.

**Is there a fix for CVE-2024-43788?** Yes. webpack (npm): upgrade to 5.94.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-43788 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-43788?** Check whether you run webpack (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- webpack (npm): upgrade to 5.94.0 or later

  ```sh
  npm install webpack@5.94.0
  ```


## Technical details

The vulnerability is a DOM Clobbering gadget in Webpack's AutoPublicPathRuntimeModule. When output.publicPath is "auto" or unset, Webpack generates runtime code that determines the script's base URL by checking document.currentScript.src. An attacker can shadow document.currentScript by injecting an HTML element (e.g., <img name="currentScript">) that the DOM traversal will return instead of the actual script element. The attacker-controlled element's src attribute then becomes __webpack_require__.p (the public path), causing Webpack's dynamic imports to load modules from the attacker's domain. This requires that the page allows injection of scriptless HTML elements with unsanitized name or id attributes. The vulnerability affects Webpack versions <5.94.0, and a patch has been applied that validates document.currentScript is actually a SCRIPT tag before using its src attribute.

## Affected products

- Webpack Webpack <5.94.0

## Identifiers

- CVE-2024-43788
- GHSA-4vvj-4cpr-p986

## Timeline

- 2024-08-27: disclosed: Vulnerability published via GHSA-4vvj-4cpr-p986
- 2024-08-27: patched: Fix released in Webpack 5.94.0 (commit 955e057)

## References

- [https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986](https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986)
- [https://github.com/webpack/webpack/issues/18718](https://github.com/webpack/webpack/issues/18718)
- [https://github.com/webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61](https://github.com/webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61)
- [https://github.com/webpack/webpack](https://github.com/webpack/webpack)
- [https://research.securitum.com/xss-in-amp4email-dom-clobbering](https://research.securitum.com/xss-in-amp4email-dom-clobbering)
- [https://scnps.co/papers/sp23_domclob.pdf](https://scnps.co/papers/sp23_domclob.pdf)

## Related threats

- [webpack buildHttp allowedUris bypass via URL userinfo](https://junglewise.ai/threats/cve-2025-68458-webpack-buildhttp-alloweduris-bypass-via-url-userinfo)
- [webpack HttpUriPlugin allowedUris bypass via HTTP redirects](https://junglewise.ai/threats/cve-2025-68157-webpack-ssrf-in-httpuriplugin-via-redirect-allow-list-bypass)
- [Webpack cross-realm object access in magic comments](https://junglewise.ai/threats/cve-2023-28154-webpack-cross-realm-object-access-in-magic-comments)