PT-2019-20063 · Webpack · Webpack-Bundle-Analyzer

Published 2019-05-23 · Updated 2019-05-23

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions webpack-bundle-analyzer versions prior to 3.3.2

Description The issue concerns Cross-Site Scripting due to the improper use of JSON.stringify() without escaping input, which may lead to security risks.

Recommendations Upgrade to version 3.3.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-PGR8-JG6H-8GW6

Affected Products

Webpack-Bundle-Analyzer

References · 6

• https://osv.dev/vulnerability/GHSA-pgr8-jg6h-8gw6 · Vendor Advisory
• https://github.com/webpack-contrib/webpack-bundle-analyzer/commit/20f2b4c553ee343f491faf63e39427fba9908c7c · Note
• https://github.com/webpack-contrib/webpack-bundle-analyzer/issues/263 · Note
• https://github.com/webpack-contrib/webpack-bundle-analyzer/pull/264 · Note
• https://snyk.io/vuln/SNYK-JS-WEBPACKBUNDLEANALYZER-174190 · Note
• https://npmjs.com/advisories/826 · Note