# GHSA-96qw-h329-v5rg: Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles

> Shakapacker exposes all build environment variables to client-side bundles, leaking secrets like API keys and database credentials to anyone accessing the site.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 8 Jan 2026

## What is GHSA-96qw-h329-v5rg?

GHSA-96qw-h329-v5rg is a vulnerability in shakapacker, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Summary

Since 2017, the default webpack plugins have passed the entire `process.env` to `EnvironmentPlugin`. This pattern exposed ALL build environment variables to client-side JavaScript bundles whenever application code (or any dependency) referenced `process.env.VARIABLE_NAME`.

This is not a regression - the vulnerable code has existed since the original Webpacker implementation. No recent code change in Shakapacker triggered this issue.

### Impact

Any environment variable in the build environment that is referenced in client-side code (including third-party dependencies) is embedded directly into the JavaScript bundle. This includes:

- `DATABASE_URL` - Database credentials
- `AWS_SECRET_ACCESS_KEY` - AWS credentials  
- `RAILS_MASTER_KEY` - Rails encrypted credentials key
- `STRIPE_SECRET_KEY`, `TWILIO_AUTH_TOKEN` - Third-party API keys
- Any other secrets present in the build environment

**Severity**: Critical - secrets are exposed in publicly accessible JavaScript files.

### Root Cause

The original code used:
```javascript
new webpack.EnvironmentPlugin(process.env)
```

This makes every environment variable available for substitution. If any code references `process.env.SECRET_KEY`, that value is embedded in the bundle.

### Patches

Upgrade to version 9.5.0 or later, which uses an allowlist approach that only exposes `NODE_ENV`, `RAILS_ENV`, and `WEBPACK_SERVE` by default.

### Workarounds

If developers cannot upgrade immediately:
1. Audit client-side code and dependencies for any `process.env.X` references to sensitive variables
2. Remove sensitive variables from the build environment
3. Override the default plugins with a custom webpack/rspack config using an explicit allowlist

### Migration

After upgrading, if client-side code needs access to specific environment variables:

**Option 1: Use the `SHAKAPACKER_PUBLIC_` prefix (recommended)**
```bash
# Variables with this prefix are automatically exposed
export SHAKAPACKER_PUBLIC_API_URL="https://api.example.com"
```

**Option 2: Use `SHAKAPACKER_ENV_VARS`**
```bash
SHAKAPACKER_ENV_VARS=API_URL,FEATURE_FLAG bundle exec rails assets:precompile
```

### Action Required

After upgrading, **rotate any secrets** that may have been exposed in previously compiled JavaScript bundles.

### Resources

- Fix PR: https://github.com/shakacode/shakapacker/pull/857

## Which versions are affected by GHSA-96qw-h329-v5rg?

4 open source packages ship an affected version, including shakapacker.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `shakapacker` | RubyGems | All versions | 9.5.0 |
| `shakapacker` | RubyGems | All versions | 9.5.0 |
| `shakapacker` | npm | All versions | 9.5.0 |
| `shakapacker` | npm | All versions | 9.5.0 |

## How do I fix GHSA-96qw-h329-v5rg?

Upgrade shakapacker to 9.5.0 or later.

## Is GHSA-96qw-h329-v5rg being exploited?

There is no known exploitation of GHSA-96qw-h329-v5rg in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-96qw-h329-v5rg and fix it if it is affected.

What it is: GHSA-96qw-h329-v5rg is a vulnerability in shakapacker, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-96qw-h329-v5rg in the wild and no public exploit code.

Affected packages and fixed versions:
- shakapacker (RubyGems): affected all versions; fixed in 9.5.0
- shakapacker (RubyGems): affected all versions; fixed in 9.5.0
- shakapacker (npm): affected all versions; fixed in 9.5.0
- shakapacker (npm): affected all versions; fixed in 9.5.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-96qw-h329-v5rg/ (Markdown: https://insights.sbomify.com/GHSA-96qw-h329-v5rg/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-96qw-h329-v5rg

---
From sbomify Insights: https://insights.sbomify.com/GHSA-96qw-h329-v5rg/
Summaries are generated and may contain mistakes; the official description above is the record.