webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browse

Description

Source code may be stolen when you access a malicious web site with non-Chromium based browser.

Recommendation

Update the webpack-dev-server package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.2.0
• Patched version(s): 5.2.1

References

• GHSA-9jgg-88mc-972h
• CVE-2025-30360
• CWE-346
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia - CVE-2025-59840
• webpack-dev-server users' source code may be stolen when they access a malicious web site - CVE-2025-30359
• Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability (GHSA-m5vv-6r4h-3vj9) - CVE-2024-35255
• tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir - CVE-2024-49364

Tags:

npm

webpack-dev-server