GHSA-76p3-8jx3-jpfq · Severity: critical · Ecosystem: npm — Prototype pollution in webpack loader-utils
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
Conclusion & alert: CVE-2022-37601 is rated High Exploit Risk (86.4/100): CVSS Critical severity, with high exploitation likelihood (EPSS 18.84%, 95th percentile). Core evidence: 2 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ | |
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-05-17 | 20.07% | 18.84% | -1.22% |
| 2 | 2026-04-07 | 19.28% | 20.07% | +0.79% |
| 3 | 2026-01-06 | — | 19.28% | — |
Full EPSS history (35 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.8 | 3.1 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
GHSA-76p3-8jx3-jpfq · Severity: critical · Ecosystem: npm — Prototype pollution in webpack loader-utils
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2022-37601 not yet assigned priority: Debian including 1 source packages (node-loader-utils), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2022-37601 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2022-37601 |
ubuntu
|
medium | CVE-2022-37601 medium priority: Ubuntu including 1 source packages (node-loader-utils), 13 status rows across 13 suites (bionic, focal, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): ignored 7, needs-triage 6. | https://ubuntu.com/security/CVE-2022-37601 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| webpack.js | loader-utils | < 1.4.1 | cpe:2.3:a:webpack.js:loader-utils:*:*:*:*:*:*:*:* |
| webpack.js | loader-utils | >= 2.0.0, < 2.0.3 | cpe:2.3:a:webpack.js:loader-utils:*:*:*:*:*:*:*:* |
| debian | debian_linux | 10.0 | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| URL | Tags |
|---|---|
| http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf | Technical Description |
| https://dl.acm.org/doi/abs/10.1145/3488932.3497769 | Technical Description |
| https://dl.acm.org/doi/pdf/10.1145/3488932.3497769 | Technical Description |
| https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L11 | Product |
| https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L47 | Product |
| https://github.com/webpack/loader-utils/issues/212 | Issue Tracking Third Party Advisory |
| https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884 | Exploit Issue Tracking Third Party Advisory |
| https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826 | Exploit Issue Tracking Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2022/12/msg00044.html | Third Party Advisory |