CVE-2020-15262 Invalid integrity hashes in webpack-subresource-integrity
Attackers can bypass Subresource Integrity checks for dynamically loaded chunks in webpack-subresource-integrity, removing browser validation protections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15262?
CVE-2020-15262 is a low-severity vulnerability in waysact webpack-subresource-integrity, published on 19 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.
Weakness: CWE-345
Which versions are affected by CVE-2020-15262?
2 open source packages ship an affected version, including webpack-subresource-integrity. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
webpack-subresource-integrity npm | All versions | 1.5.1 |
webpack-subresource-integrity npm | All versions | 1.5.1 |
Products include Webpack-Subresource-Integrity Project Webpack-Subresource-Integrity.
How do I fix CVE-2020-15262?
Upgrade webpack-subresource-integrity to 1.5.1 or later.
Is CVE-2020-15262 being exploited?
There is no known exploitation of CVE-2020-15262 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1774225212, CLSA-2026-1779238044, GHSA-4fc4-chg7-h8gh.