CVE-2025-68458 webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo username:password@host. If allowedUris...

CVE-2025-68458

Webpack CVE-2025-68458 affects Webpack’s HTTP(S) resolver (HttpUriPlugin) when experiments.buildHttp is enabled. A crafted URL containing userinfo (username:password@host) can bypass allowedUris checks and cause the build process to request resources from internal or non-whitelisted hosts, enabli...

CVE-2025-68458 webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo username:password@host. If allowedUris...

@abdul-kissflow/form-field-scripts (0.0.7), @ableaura/ableui (0.1.0) +2557 more potentially affected by CVE-2025-68458 via webpack (>=5.49.0, <=5.104.0)

webpack NPM version =5.49.0, =0.0.1, =0.0.1, =0.0.1, =4.9.5, =0.0.1, =1.0.0, =1.0.0-rc2, =2.0.5-beta.11, =1.0.7-beta.4, =1.0.7-beta.4, =1.2.1-alpha.0 and more Source cves: CVE-2025-68458 Source advisory: SNYK:JS-WEBPACK-15235959...

@abdul-kissflow/form-field-scripts (0.0.7), @ableaura/ableui (0.1.0) +2557 more potentially affected by CVE-2025-68458 via webpack (>=5.49.0, <=5.104.0)

webpack NPM version =5.49.0, =0.0.1, =0.0.1, =0.0.1, =4.9.5, =0.0.1, =1.0.0, =1.0.0-rc2, =2.0.5-beta.11, =1.0.7-beta.4, =1.0.7-beta.4, =1.2.1-alpha.0 and more Source cves: CVE-2025-68458 Source advisory: OSV:GHSA-8FGC-7CC6-RX7X...

GHSA-8FGC-7CC6-RX7X webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

Summary When experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo username:password@host. If allowedUris enforcement relies on a raw string prefix check e.g.,...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the HttpUriPlugin component. An attacker can cause unauthorized outbound requests to internal or otherwise restricted endpoints and include untrusted content in build outputs by crafting URLs with...

webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

Summary When experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo username:password@host. If allowedUris enforcement relies on a raw string prefix check e.g.,...

@abdul-kissflow/form-field-scripts (0.0.7), @ableaura/ableui (0.1.0) +2557 more potentially affected by CVE-2025-68157 via webpack (>=5.49.0, <=5.103.0)

webpack NPM version =5.49.0, =0.0.1, =0.0.1, =0.0.1, =4.9.5, =0.0.1, =1.0.0, =1.0.0-rc2, =2.0.5-beta.11, =1.0.7-beta.4, =1.0.7-beta.4, =1.2.1-alpha.0 and more Source cves: CVE-2025-68157 Source advisory: OSV:GHSA-38R7-794H-5758...

webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence

Summary When experiments.buildHttp is enabled, webpack’s HTTPS resolver HttpUriPlugin enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the HttpUriPlugin component when HTTP redirects are followed without re-validating the allowed URIs. An attacker can cause unauthorized network requests to internal services and inclusion of untruste...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the HttpUriPlugin component when HTTP redirects are followed without re-validating the allowed URIs. An attacker can cause unauthorized network requests to internal services and inclusion of untruste...

PT-2026-6640

Name of the Vulnerable Software and Affected Versions Webpack versions 5.49.0 through 5.103.9 Description Webpack’s HTTPS resolver HttpUriPlugin does not re-validate allowed URLs after following HTTP 30x redirects when the experiments.buildHttp feature is enabled. This allows an import that appea...

Webpack 代码问题漏洞

Webpack is a module bundler developed by Webpack contributors. Its primary purpose is to bundle JavaScript files for use in browsers. However, it can also convert, bundle, or package almost any resource or asset. Versions of Webpack from 5.49.0 to 5.104.1 contained code vulnerabilities. These...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in values including series paths, patch filenames, and numeric parameters, which are read from patch.yaml. An attacker who can control inputs to this file can cause shell commands to be run on the build host by injecti...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in values including series paths, patch filenames, and numeric parameters, which are read from patch.yaml. An attacker who can control inputs to this file can cause shell commands to be run on the build host by injecti...

CVE-2026-25143

melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds...

CVE-2026-24844

melange allows users to build apk packages using declarative pipelines. From version 0.3.0 to before 0.40.3, an attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses $vars. or $inputs. substitutions in...

EUVD-2026-5370

melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file e.g., through pull request-driven CI or build-as-a-service scenarios could read arbitrary files from the host system. The...

CVE-2026-25145

melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file e.g., through pull request-driven CI or build-as-a-service scenarios could read arbitrary files from the host system. The...