Security Bulletin: IBM Edge Data Collector uses webpack-dev-server - 4.15.2 which is vulnerable to CVE-2025-30360.

Summary IBM Edge Data Collector uses webpack-dev-server - 4.15.2 which is vulnerable to CVE-2025-30360. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2025-30360 DESCRIPTION: webpack-dev-server allows users to use webpack with a development server...

CVE-2025-30360 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, argo-workflows...

CVE-2025-30360 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, argo-workflows...

@all-star/base (>=0.17.0, <=0.18.2), @all-star/react (>=0.17.0, <=0.18.2) +163 more potentially affected by CVE-2025-30360 via webpack-dev-server (>=5.0.0, <=5.2.0)

webpack-dev-server NPM version =5.0.0, =0.17.0, =0.17.0, =0.17.0, =18.0.0-next.0, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2-develop-1171, =0.4.0, =0.1.15, =0.0.2, =0.0.2, =0.1.3 and more Source cves: CVE-2025-30360 Source advisory: OSV:GHSA-9JGG-88MC-972H...

CVE-2025-30360

webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The Origin header is checked to prevent Cross-si...

CVE-2025-30360

The CVE-2025-30360 entry concerns webpack-dev-server prior to v5.2.1, where an Origin header check for WebSocket connections was insufficient, allowing IP-based origins to access the WebSocket and potentially exfiltrate source code to malicious sites using non-Chromium browsers. The issue is miti...

CVE-2025-30360 webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The Origin header is checked to prevent Cross-si...

CVE-2025-30360 webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The Origin header is checked to prevent Cross-si...

CVE-2025-30360 webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The Origin header is checked to prevent Cross-si...

CVE-2025-30360

creationtimestamp| type| source ---|---|--- 2025-06-03 15:55:19+00:00| published-proof-of-concept| https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h 2025-06-03 18:11:11+00:00| seen|...