Executive brief
webpack-dev-server is a development tool used by JavaScript developers to test applications locally during development. Attackers can trick developers into visiting a malicious website, which then silently extracts the developer's source code by leveraging loose cross-origin policies and prototype pollution. This could expose proprietary business logic, API keys, and other sensitive information embedded in the code.
Technical details
The vulnerability is a cross-origin information disclosure (CWE-749) affecting webpack-dev-server. The root cause is that webpack-dev-server does not enforce proper CORS headers, allowing classic script tags from arbitrary origins to load and execute bundled code. An attacker can inject a <script src="http://localhost:PORT/ENTRYPOINT"> tag from a malicious website; because classic script requests bypass same-origin policy, the script loads and executes in the attacker's page context. By combining this with prototype pollution attacks against Array.prototype.forEach, an attacker gains access to the __webpack_require__ function and the __webpack_modules__ object. Using Function::toString() against these objects exposes complete source code. The attack requires the developer to: (1) visit a malicious website while webpack-dev-server is running, and (2) the attacker to guess or know the port number and output entrypoint script path. The fix, available in version 5.2.1, adds cross-origin request validation and requires Access-Control-Allow-Origin headers for cross-origin requests.
Affected products
- webpack webpack-dev-server <= 5.2.0
Timeline
- 2025-06-03: disclosed
- 2025-06-04: patched: Fixed in version 5.2.1
References
- https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v
- https://github.com/webpack/webpack-dev-server/commit/5c9378bb01276357d7af208a0856ca2163db188e
- https://github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239
- https://github.com/webpack/webpack-dev-server