webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. Note that the attacker has to know the port and the output entrypoint script path. Combined with prototype pollution, the attacker can get a reference to the webpack runtime variables. By using `Function::toString` against the values in `__webpack_modules__`, the attacker can get the source code. Version 5.2.1 contains a patch for the issue.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Webpack.js
  • Webpack-dev-server

Configuration 1 [-]

cpe:2.3:a:webpack.js:webpack-dev-server:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239 cve-icon cve-icon cve-icon
https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-30359 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-30359 cve-icon
History

Fri, 03 Oct 2025 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Webpack.js
Webpack.js webpack-dev-server
CPEs cpe:2.3:a:webpack.js:webpack-dev-server:*:*:*:*:*:*:*:*
Vendors & Products Webpack.js
Webpack.js webpack-dev-server

Fri, 06 Jun 2025 19:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 03 Jun 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 03 Jun 2025 17:45:00 +0000

Type Values Removed Values Added
Description webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. Note that the attacker has to know the port and the output entrypoint script path. Combined with prototype pollution, the attacker can get a reference to the webpack runtime variables. By using `Function::toString` against the values in `__webpack_modules__`, the attacker can get the source code. Version 5.2.1 contains a patch for the issue.
Title webpack-dev-server users' source code may be stolen when they access a malicious web site
Weaknesses CWE-749
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2025-06-03T17:39:16.531Z

Updated: 2025-06-03T17:50:03.130Z

Reserved: 2025-03-21T14:12:06.271Z

Link: CVE-2025-30359

cve-icon Vulnrichment

Updated: 2025-06-03T17:49:52.996Z

cve-icon NVD

Status : Analyzed

Published: 2025-06-03T18:15:25.243

Modified: 2025-10-03T01:12:23.030

Link: CVE-2025-30359

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-06-03T17:39:16Z

Links: CVE-2025-30359 - Bugzilla