GCVE - cpe:2.3:a:webpack.js:loader-utils:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:webpack.js:loader-utils:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Webpack.Js (`d4e504ae-a5fa-563b-b2c0-1a1cd26793af`)
Product	Loader Utils (`0173f8b1-ef9f-553b-bd3c-e583bd62a00c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/node-loader-utils`	purl2cpe	2026-06-01 10:16:56.697533
`pkg:deb/ubuntu/node-loader-utils`	purl2cpe	2026-06-01 10:16:56.697535
`pkg:github/webpack/loader-utils`	purl2cpe	2026-06-01 10:16:56.697538
`pkg:maven/org.webjars.npm/loader-utils`	purl2cpe	2026-06-01 10:16:56.697539
`pkg:npm/loader-utils`	purl2cpe	2026-06-01 10:16:56.697541

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-37603`	vulnerable	2026-06-08 05:47:12.953886	Details available A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js. Published: 2022-10-14T00:00:00.000Z Updated: 2025-05-15T14:51:37.708Z Open on db.gcve.eu Reference links https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38 https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107 https://github.com/webpack/loader-utils/issues/213 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-37601`	vulnerable	2026-06-08 05:47:12.951053	Details available Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. Published: 2022-10-12T00:00:00.000Z Updated: 2024-10-28T19:41:38.297Z Open on db.gcve.eu Reference links https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L11 https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L47 https://github.com/webpack/loader-utils/issues/212 https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884 https://dl.acm.org/doi/abs/10.1145/3488932.3497769	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-37599`	vulnerable	2026-06-08 05:47:12.950202	Details available A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js. Published: 2022-10-11T00:00:00.000Z Updated: 2025-11-04T18:14:20.740Z Open on db.gcve.eu Reference links https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38 https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L83 https://github.com/webpack/loader-utils/issues/211 https://github.com/webpack/loader-utils/issues/216 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.