-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shakapacker | npm | < 9.5.0 | 9.5.0 |
| shakapacker | rubygems | < 9.5.0 | 9.5.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the default webpack and rspack configurations within Shakapacker. Specifically, the getPlugins function in both package/plugins/webpack.ts and package/plugins/rspack.ts used new webpack.EnvironmentPlugin(process.env) and new rspack.EnvironmentPlugin(process.env) respectively. This action passed all build-time environment variables to the client-side JavaScript bundles. If any part of the application's frontend code (or its dependencies) referenced an environment variable (e.g., process.env.DATABASE_URL), its value would be embedded directly into the public-facing JavaScript files. This exposed sensitive information and secrets, such as database credentials, API keys, and Rails master keys, to anyone inspecting the compiled assets. The patch remediates this by replacing the dangerous process.env with a call to a new getFilteredEnv() function. This new function uses a strict allowlist approach, only exposing non-sensitive variables by default (NODE_ENV, RAILS_ENV, WEBPACK_SERVE) and variables explicitly marked as public via a SHAKAPACKER_PUBLIC_ prefix or the SHAKAPACKER_ENV_VARS setting.
getPluginspackage/plugins/webpack.ts
getPluginspackage/plugins/rspack.ts