CVE-2022-37601: debian debian_linux
Vulnerability summary
CVE-2022-37601 is a critical (CVSS 9.8) vulnerability in debian debian_linux. EPSS estimates a 3.50% chance of exploitation in the next 30 days, higher than 89.1% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 12-10-2022PublishedVulnerability first disclosed.
- 28-10-2024Last modifiedVulnerability information updated.
Description
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · NpmEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
3.50%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
Increase +0.65 pp
From 2.85% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundLoader Utils
Maturity: poc
Xmldom
Maturity: poc
Weaknesses
CWE · root cause- CWE-1321Improperly Controlled Modification of Object Prototype AttributesThe product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
- CWE-915Improperly Controlled Modification of Dynamically-Determined Object AttributesThe product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Wordpress3 products
- elasticpress≤ 4.3.1 (fixed in 4.4.0)
- insert-special-characters≤ 1.0.5 (fixed in 1.0.6)
- maps-block-apple≤ 1.0.3 (fixed in 1.1.0)
Debian2 products
- node-loader-utils< 1.1.0-2+deb10u1 | < 2.0.3-1
- debian_linuxEOL10.0
Chainguard1 product
- jitsucom-jitsu< 2.11.0-r6
Npm1 product
- loader-utils≥ 2.0.0, < 2.0.3 | < 1.4.1
Ubuntu1 product
- node-loader-utilsAll versions (No fix recorded)
Webpack.js1 product
- loader-utils< 1.4.1 | ≥ 2.0.0, < 2.0.3
Wolfi1 product
- jitsucom-jitsu< 2.11.0-r6
7 vendors · 10 products
References
22 links- users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdfWEBTechnical Description
