CVE-2022-37603 (High) detected in loader-utils-1.2.3.tgz
mend-bolt-for-github opened this issue · 1 comments
CVE-2022-37603 - High Severity Vulnerability
Vulnerable Library - loader-utils-1.2.3.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz
Path to dependency file: /tilt_modules/tilt_inspector/package.json
Path to vulnerable library: /tilt_modules/tilt_inspector/node_modules/loader-utils/package.json
Dependency Hierarchy:
- tilt-inspector-0.1.8.tgz (Root Library)
- next-11.1.2.tgz
- styled-jsx-4.0.1.tgz
- ❌ loader-utils-1.2.3.tgz (Vulnerable Library)
- styled-jsx-4.0.1.tgz
- next-11.1.2.tgz
Found in base branch: master
Vulnerability Details
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
Publish Date: 2022-10-14
URL: CVE-2022-37603
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-3rfm-jhwj-7488
Release Date: 2022-10-14
Fix Resolution: loader-utils - 1.4.2,2.0.4,3.2.1
Step up your Open Source Security Game with Mend here
👋 Thanks for reporting!