1994 matches found
Malicious Package
Overview webpack-cdn-fetcher is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
webpack-dev-server CVE-2026-14620 open-editor CSRF check
CVE-2026-14620 GHSA-f5vj-f2hx-8m93: webpack-dev-server = 5.2.5 allows cross-site requests to GET /webpack-dev-server/open-editor?fileName=, which calls launchEditor and can spawn an editor on an attacker-chosen path. The CVE-2026-6402 guard only blocks no-cors subresources; cross-site navigations...
webpack-dev-server CVE-2026-14620 open-editor CSRF detect
Detects CVE-2026-14620 in webpack-dev-server = 5.2.5: cross-site GET /webpack-dev-server/open-editor?fileName= reaches launchEditor. Probes cors and no-cors Sec-Fetch combinations; vulnerable when cors cross-site returns HTTP 200 while no-cors cross-site is blocked 403. !/usr/bin/env python3 --...
webpack_devserver 5.2.5 - CSRF
Exploit Title: webpackdevserver 5.2.5 - Csrf Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/webpack/webpack-dev-server Software Link: https://www.npmjs.com/package/webpack-dev-server Version: reaches launchEditorfileName from a CROSS-ORIGIN...
CLSA-2026-1786365773 TuxCare security update for webpack-dev-server (4 CVEs)
TuxCare rebuilt webpack-dev-server to address 4 CVEs. Fixed in 3.11.3-tuxcare.4...
CLSA-2026-1786365627 TuxCare security update for webpack-dev-server (2 CVEs)
TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.15.1-tuxcare.4...
PT-2026-80036
TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.15.1-tuxcare.4...
PT-2026-80037
TuxCare rebuilt webpack-dev-server to address 4 CVEs. Fixed in 3.11.3-tuxcare.4...
Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition
Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Developer Edition version 2.14.0 Vulnerability Details CVEID:CVE-2026-14620 DESCRIPTION: webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and...
Malicious code in boxy-global-modules-webpack-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce609c23d8c990c21c16692270dbb62589c6f63e716994c31e5ed4f466dcad7 On require of the package's main entry, loader.js immediately fetches a platform-specific opaque binary over HTTPS from hardcoded Cloudflare Workers...
MAL-2026-13050 Malicious code in boxy-global-modules-webpack-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce609c23d8c990c21c16692270dbb62589c6f63e716994c31e5ed4f466dcad7 On require of the package's main entry, loader.js immediately fetches a platform-specific opaque binary over HTTPS from hardcoded Cloudflare Workers...
MAL-2026-13097 Malicious code in boxy-webpack-test-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c209d103503640b71c427b13bc614b157bc1cbcd371c3a35a0f0b060d7f39de On require of the package, index.js loads polyfill.js which downloads a platform-specific binary from one of four string-split Cloudflare Workers hos...
Malicious code in sme-scripts-shared-library-webpack-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a07df8d1831729273ad5bbc396191492c36cbf0f4d870af35c1101579ce0c9 [email protected] executes an install/import-time dropper. index.js requires./setup at module load, which selects a...
MAL-2026-12072 Malicious code in specials-obid-webpack (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef5ac97b682821ce99ff6152a28467cd5ec91903d061ba1fc70ef7a3e6b9be03 On require of the package, vendor.js selects a URL path by host platform, downloads a binary over HTTPS from destination hostnames assembled at runti...
CLSA-2026-1785204346 TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.7.1-tuxcare.4...
CLSA-2026-1784943286 TuxCare security update for webpack-dev-server (1 CVE)
TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 2.7.1-tuxcare.3...
CLSA-2026-1784943228 TuxCare security update for webpack-dev-server (1 CVE)
TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 2.11.5-tuxcare.3...
CLSA-2026-1784769600 TuxCare security update for webpack-dev-server (1 CVE)
TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 3.11.2-tuxcare.2...