DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS
- Severity:
- Medium
Description
Hi, Rspack|Webpack developer team!
Recommendation
Update the @rspack/core package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.0.0-rc.1
- Patched version(s): 1.0.0-rc.1
References
Related Issues
- Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
- Improper Verification of Cryptographic Signature in node-forge (GHSA-cfm4-qjh2-4765) - CVE-2022-24771
- Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) - CVE-2023-34092
- fast-xml-parser regex vulnerability patch could be improved from a safety perspective - Vulnerability
- Tags:
- npm
- @rspack/core
Anything's wrong? Let us know Last updated on September 19, 2024