CVE-2025-30359 webpack-dev-server users' source code may be stolen when they access a malicious web site

🗓️ 03 Jun 2025 17:39:16Reported by GitHub_MType

Webpack-dev-server prior to version 5.2.1 allows source code theft via malicious websites.

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: IBM QRadar Log Source Management app for IBM QRadar SIEM includes components with known vulnerabilities	15 Aug 202514:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition is vulnerable to Exposed Dangerous Method or Function, Origin Validation Error due to webpack-dev-server	17 Dec 202510:46	–	ibm
IBM Security Bulletins	Security Bulletin: Source Code Exposure Vulnerability in webpack-dev-server (Fixed in Version 5.2.1) affects watsonx.data	4 Mar 202615:30	–	ibm
Chainguard	CVE-2025-30359 vulnerabilities	2 Jul 202501:16	–	cgr
Circl	CVE-2025-30359	3 Jun 202515:55	–	circl
CNNVD	webpack-dev-server 安全漏洞	3 Jun 202500:00	–	cnnvd
CVE	CVE-2025-30359	3 Jun 202517:39	–	cve
EUVD	EUVD-2025-16767	3 Oct 202520:07	–	euvd
Github Security Blog	webpack-dev-server users' source code may be stolen when they access a malicious web site	4 Jun 202521:09	–	github
Github Security Blog	webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins	18 May 202613:31	–	github

[
  {
    "vendor": "webpack",
    "product": "webpack-dev-server",
    "versions": [
      {
        "version": "< 5.2.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v
github	www.github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239

03 Jun 2025 17:39Current

CVSS 3.15.3

EPSS0.00427

CWE-749