Executive brief
Shakapacker is a bundler/webpack configuration tool for Ruby on Rails applications that packages front-end code for deployment. A design flaw since 2017 exposes all build environment variables—including database credentials, API keys, and Rails encryption keys—directly into client-side JavaScript bundles whenever code references them. These secrets are then accessible to anyone who downloads the public JavaScript files, enabling attackers to compromise databases, cloud infrastructure, and third-party services.
Technical details
Shakapacker's EnvironmentPlugin passes the entire process.env object to webpack without filtering, making every environment variable available for code substitution. When application code or dependencies reference process.env.VARIABLE_NAME (e.g., process.env.DATABASE_URL), the value is embedded directly into the compiled JavaScript bundle. This is not a recent regression but a long-standing design pattern from the original 2017 Webpacker implementation. No authentication or user interaction is required; an attacker simply needs to inspect publicly available JavaScript bundles. The vulnerability affects all versions prior to 9.5.0, which implements an allowlist approach exposing only NODE_ENV, RAILS_ENV, and WEBPACK_SERVE by default. Patch is available; after upgrading, secrets in previously compiled bundles should be rotated.
Affected products
- Shakacode Shakapacker All versions prior to 9.5.0
Timeline
- 2026-01-08: disclosed: Advisory GHSA-96qw-h329-v5rg published
- 2026-01-08: patched: Version 9.5.0 released with allowlist-based fix