CVE-2024-43788: DOM Clobbering Gadget in Webpack's AutoPublicPathRuntimeModule leads to XSS
Summary
CVE-2024-43788: Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS. Affects webpack versions >= 5.0.0-alpha.0, < 5.94.0. Fixed in 5.94.0. How to fix ↓
Also tracked for
- node-webpack · Debian:11
The same CVE-2024-43788 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Webpack is an open-source JavaScript module bundler widely used in web development. It allows developers to bundle JavaScript files for usage in a browser. The AutoPublicPathRuntimeModule is a module in Webpack that dynamically resolves and loads additional JavaScript files. This module is vulnerable to a DOM Clobbering attack, which can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements are present.
Vulnerability Detail
The vulnerability arises from a DOM Clobbering gadget present in Webpack's AutoPublicPathRuntimeModule. This gadget can be exploited by an attacker to transform seemingly benign HTML markups into executable code. By manipulating the 'currentScript' attribute, an attacker can control the 'src' attribute used by Webpack to load additional scripts. This can result in arbitrary script loading from the attacker's server, leading to XSS attacks.
How To Fix
Latest published version: 5.112.0 as of 22 Oct 2026
npm install webpack@5.112.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.94.0
This is the first release that contains the fix.
npm install webpack@5.94.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is recommended to apply the official patch once it is released by the Webpack development team.
Conclusion
The DOM Clobbering vulnerability in Webpack's AutoPublicPathRuntimeModule can lead to cross-site scripting (XSS) attacks in web applications that include Webpack-compiled code. It is crucial for the Webpack development team to address this vulnerability by implementing a patch that makes the code resilient to DOM Clobbering attacks.
See every vulnerability recorded for webpack →
FAQ
Webpack is a JavaScript module bundler used in web development to bundle JavaScript files for usage in a browser.
DOM Clobbering is a code-reuse attack where an attacker transforms seemingly benign HTML markups into executable code by leveraging gadgets present in existing JavaScript code.
The vulnerability allows an attacker to control the 'src' attribute used by Webpack to load additional scripts. This can result in arbitrary script loading from the attacker's server, leading to cross-site scripting (XSS) attacks.
Yes, a real-world exploitation of this vulnerability has been discovered in the Canvas LMS. Once the issue is patched, more details about the exploitation may be shared.
The Webpack development team should implement a patch that makes the code resilient to DOM Clobbering attacks. It is recommended to apply the official patch once it is released.
References
Related vulnerabilities
Recent vulnerabilities recorded for webpack.
