{"answers":{"affected":"4 open source packages ship an affected version, including shakapacker.","exploited":"There is no known exploitation of GHSA-96qw-h329-v5rg in the wild and no public exploit code.","fix":"Upgrade shakapacker to 9.5.0 or later.","what":"GHSA-96qw-h329-v5rg is a vulnerability in shakapacker, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-96qw-h329-v5rg and fix it if it is affected.\n\nWhat it is: GHSA-96qw-h329-v5rg is a vulnerability in shakapacker, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-96qw-h329-v5rg in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- shakapacker (RubyGems): affected all versions; fixed in 9.5.0\n- shakapacker (RubyGems): affected all versions; fixed in 9.5.0\n- shakapacker (npm): affected all versions; fixed in 9.5.0\n- shakapacker (npm): affected all versions; fixed in 9.5.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-96qw-h329-v5rg/ (Markdown: https://insights.sbomify.com/GHSA-96qw-h329-v5rg/index.md)","id":"GHSA-96qw-h329-v5rg","markdown":"https://insights.sbomify.com/GHSA-96qw-h329-v5rg/index.md","name":"GHSA-96qw-h329-v5rg","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Ruby/JS build tool","requires_auth":"none","summary":"Shakapacker exposes all build environment variables to client-side bundles, leaking secrets like API keys and database credentials to anyone accessing the site.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\nSince 2017, the default webpack plugins have passed the entire `process.env` to `EnvironmentPlugin`. This pattern exposed ALL build environment variables to client-side JavaScript bundles whenever application code (or any dependency) referenced `process.env.VARIABLE_NAME`.\n\nThis is not a regression - the vulnerable code has existed since the original Webpacker implementation. No recent code change in Shakapacker triggered this issue.\n\n### Impact\n\nAny environment variable in the build environment that is referenced in client-side code (including third-party dependencies) is embedded directly into the JavaScript bundle. This includes:\n\n- `DATABASE_URL` - Database credentials\n- `AWS_SECRET_ACCESS_KEY` - AWS credentials  \n- `RAILS_MASTER_KEY` - Rails encrypted credentials key\n- `STRIPE_SECRET_KEY`, `TWILIO_AUTH_TOKEN` - Third-party API keys\n- Any other secrets present in the build environment\n\n**Severity**: Critical - secrets are exposed in publicly accessible JavaScript files.\n\n### Root Cause\n\nThe original code used:\n```javascript\nnew webpack.EnvironmentPlugin(process.env)\n```\n\nThis makes every environment variable available for substitution. If any code references `process.env.SECRET_KEY`, that value is embedded in the bundle.\n\n### Patches\n\nUpgrade to version 9.5.0 or later, which uses an allowlist approach that only exposes `NODE_ENV`, `RAILS_ENV`, and `WEBPACK_SERVE` by default.\n\n### Workarounds\n\nIf developers cannot upgrade immediately:\n1. Audit client-side code and dependencies for any `process.env.X` references to sensitive variables\n2. Remove sensitive variables from the build environment\n3. Override the default plugins with a custom webpack/rspack config using an explicit allowlist\n\n### Migration\n\nAfter upgrading, if client-side code needs access to specific environment variables:\n\n**Option 1: Use the `SHAKAPACKER_PUBLIC_` prefix (recommended)**\n```bash\n# Variables with this prefix are automatically exposed\nexport SHAKAPACKER_PUBLIC_API_URL=\"https://api.example.com\"\n```\n\n**Option 2: Use `SHAKAPACKER_ENV_VARS`**\n```bash\nSHAKAPACKER_ENV_VARS=API_URL,FEATURE_FLAG bundle exec rails assets:precompile\n```\n\n### Action Required\n\nAfter upgrading, **rotate any secrets** that may have been exposed in previously compiled JavaScript bundles.\n\n### Resources\n\n- Fix PR: https://github.com/shakacode/shakapacker/pull/857","ecosystems":["RubyGems","npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles","id":"GHSA-96qw-h329-v5rg","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"RubyGems","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"RubyGems","fixed":["9.5.0"],"introduced":["0"],"last_affected":[],"package":"shakapacker","purl":null,"source":"GHSA-96qw-h329-v5rg"},{"ecosystem":"RubyGems","fixed":["9.5.0"],"introduced":["0"],"last_affected":[],"package":"shakapacker","purl":"pkg:gem/shakapacker","source":"GHSA-96qw-h329-v5rg"},{"ecosystem":"npm","fixed":["9.5.0"],"introduced":["0"],"last_affected":[],"package":"shakapacker","purl":null,"source":"GHSA-96qw-h329-v5rg"},{"ecosystem":"npm","fixed":["9.5.0"],"introduced":["0"],"last_affected":[],"package":"shakapacker","purl":"pkg:npm/shakapacker","source":"GHSA-96qw-h329-v5rg"}],"products":null,"published":"2026-01-08","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Shakapacker exposes all build environment variables to client-side bundles, leaking secrets like API keys and database credentials to anyone accessing the site.","url":"https://insights.sbomify.com/GHSA-96qw-h329-v5rg/"}