CVE-2022-37601: Prototype pollution in webpack loader-utils

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-10-12 · updated 2026-06-17
Weakness: CWE-1321

Description

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Affected products

Debian Linux: 10.0
Webpack.Js Loader-Utils: before 1.4.1; from 2.0.0 before 2.0.3 — fixed in 1.4.1, 2.0.3
Npm Loader-Utils: from 2.0.0 before 2.0.3; before 1.4.1 — fixed in 2.0.3, 1.4.1

How to fix

Upgrade to a fixed version: Webpack.Js Loader-Utils 1.4.1, 2.0.3; Npm Loader-Utils 2.0.3, 1.4.1. Check the vendor advisory for mitigations.

References

http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf
https://dl.acm.org/doi/abs/10.1145/3488932.3497769
https://dl.acm.org/doi/pdf/10.1145/3488932.3497769
https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L11
https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L47
https://github.com/webpack/loader-utils/issues/212
https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884
https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826
https://lists.debian.org/debian-lts-announce/2022/12/msg00044.html
http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf
https://dl.acm.org/doi/abs/10.1145/3488932.3497769
https://dl.acm.org/doi/pdf/10.1145/3488932.3497769

Get alerted when CVE-2022-37601 or the next vulnerability affects your stack