Source Code Exposure in Webpack Dev Server by Webpack

CVE-2025-30359

What is CVE-2025-30359?

The webpack-dev-server, used for live reloading during development, is susceptible to a vulnerability that allows theft of users' source code through malicious websites. Attackers can exploit the fact that requests for classic scripts aren't bound by the same origin policy. By injecting malicious scripts into their sites and knowing the port and script path of the webpack output entry point, they can execute harmful code. This exploitation can expose webpack runtime variables. Furthermore, when combined with prototype pollution techniques, attackers have the ability to extract source code through specific functions. Version 5.2.1 has been released to patch this issue.

References