CVE-2025-30360 webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

🗓️ 03 Jun 2025 17:41:59Reported by GoogleType

osv

osv🔗 osv.dev👁 3 Views

webpack-dev-server prior to 5.2.1 allows source code theft via IP address Origin headers from browsers.

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses webpack-dev-server - 4.15.2 which is vulnerable to CVE-2025-30360.	29 Dec 202513:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Log Source Management app for IBM QRadar SIEM includes components with known vulnerabilities	15 Aug 202514:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition is vulnerable to Exposed Dangerous Method or Function, Origin Validation Error due to webpack-dev-server	17 Dec 202510:46	–	ibm
IBM Security Bulletins	Security Bulletin: Source Code Exposure Vulnerability in webpack-dev-server (Fixed in Version 5.2.1) affects watsonx.data	4 Mar 202615:30	–	ibm
Chainguard	CVE-2025-30360 vulnerabilities	2 Jul 202501:16	–	cgr
Circl	CVE-2025-30360	3 Jun 202515:55	–	circl
CNNVD	webpack-dev-server 访问控制错误漏洞	3 Jun 202500:00	–	cnnvd
CVE	CVE-2025-30360	3 Jun 202517:41	–	cve
Cvelist	CVE-2025-30360 webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser	3 Jun 202517:41	–	cvelist
EUVD	EUVD-2025-16764	3 Oct 202520:07	–	euvd

Source	Link
github	www.github.com/webpack/webpack-dev-server/blob/55220a800ba4e30dbde2d98785ecf4c80b32f711/lib/Server.js
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30360.json
github	www.github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-30360
github	www.github.com/webpack/webpack-dev-server/commit/5c9378bb01276357d7af208a0856ca2163db188e
github	www.github.com/webpack/webpack-dev-server/commit/72efaab83381a0e1c4914adf401cbd210b7de7eb

10 Apr 2026 05:25Current

7.3High risk

Vulners AI Score7.3

CVSS 3.16.5

EPSS0.00039

cve 2025 30360 webpack dev server source code theft ip address headers cross site websocket hijacking cve 2018 14732 version 5.2.1 patch.