Cross-site WebSocket Hijacking

🗓️ 09 Jun 2025 06:00:48Reported by Veracode Vulnerability DatabaseType

Cross-site WebSocket hijacking in webpack-dev-server due to poor Origin header validation.

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses webpack-dev-server - 4.15.2 which is vulnerable to CVE-2025-30360.	29 Dec 202513:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Log Source Management app for IBM QRadar SIEM includes components with known vulnerabilities	15 Aug 202514:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition is vulnerable to Exposed Dangerous Method or Function, Origin Validation Error due to webpack-dev-server	17 Dec 202510:46	–	ibm
IBM Security Bulletins	Security Bulletin: Source Code Exposure Vulnerability in webpack-dev-server (Fixed in Version 5.2.1) affects watsonx.data	4 Mar 202615:30	–	ibm
Chainguard	CVE-2025-30360 vulnerabilities	2 Jul 202501:16	–	cgr
Circl	CVE-2025-30360	3 Jun 202515:55	–	circl
CNNVD	webpack-dev-server 访问控制错误漏洞	3 Jun 202500:00	–	cnnvd
CVE	CVE-2025-30360	3 Jun 202517:41	–	cve
Cvelist	CVE-2025-30360 webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser	3 Jun 202517:41	–	cvelist
EUVD	EUVD-2025-16764	3 Oct 202520:07	–	euvd

Vulners

Node

Source	Link
github	www.github.com/webpack/webpack-dev-server/commit/72efaab83381a0e1c4914adf401cbd210b7de7eb
github	www.github.com/webpack/webpack-dev-server/blob/55220a800ba4e30dbde2d98785ecf4c80b32f711/lib/Server.js
github	www.github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239
github	www.github.com/advisories/GHSA-9jgg-88mc-972h
github	www.github.com/webpack/webpack-dev-server/commit/5c9378bb01276357d7af208a0856ca2163db188e
github	www.github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h

03 Jun 2026 09:24Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.16.5

EPSS0.00039

SSVC