CVE-2022-37601 Prototype pollution in webpack loader-utils
Prototype pollution in webpack loader-utils allows attackers to manipulate object prototypes, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-37601?
CVE-2022-37601 is a critical vulnerability in Debian Debian Linux, published on 12 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
Weakness: CWE-1321
Which versions are affected by CVE-2022-37601?
4 open source packages ship an affected version, including loader-utils. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
loader-utils npm | All versions | 1.4.1 |
loader-utils npm | All versions | 1.4.1 |
loader-utils npm | From 2.0.0 | 2.0.3 |
loader-utils npm | From 2.0.0 | 2.0.3 |
Products include Debian Debian Linux, Webpack.js Loader-Utils.
How do I fix CVE-2022-37601?
Upgrade loader-utils to a fixed version for your release line: 1.4.1 or 2.0.3.
Is CVE-2022-37601 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-37601 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-26161, CLSA-2026-1773447386, DEBIAN-CVE-2022-37601, DLA-3258-1, GHSA-76p3-8jx3-jpfq, ROOT-APP-NPM-CVE-2022-37601 and 1 more.