-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| webpack | npm | >= 5.0.0, < 5.76.0 | 5.76.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key areas:
constructor.name check for RegExp in webpackInclude/webpackExclude validation was insecure, as it could be bypassed via cross-realm objects. The patch replaces this with instanceof checks.vm.runInNewContext evaluation of magic comments allowed cross-realm object injection. The patch adds sanitization via RegExp reconstruction and JSON cloning.
Both functions directly process attacker-controllable input (import options and magic comments) and were modified in the security patch, confirming their role in the vulnerability.