6.5

CVE-2025-30360: webpack webpack-dev-server Origin Validation Error

CVSS: 6.5v3.1MediumAnalyzed
AliasesCGA-5m72-6h4q-chj3CGA-5ww9-vv29-v74fCGA-6jqq-j65q-pv8x
Published 03-06-2025Last modified 03-06-2025
Open JSON

Vulnerability summary

CVE-2025-30360 is a medium (CVSS 6.5) Origin Validation Error vulnerability in webpack webpack-dev-server. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.3% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.34%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-XG8H-HG74-6GJ9

Timeline

  1. 03-06-2025
    PublishedVulnerability first disclosed.
  2. 03-06-2025
    Last modifiedVulnerability information updated.

Description

webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.34%

Chance of exploitation in the next 30 days

Percentile

26%

Versus all other CVEs

30-day change

0.00 pp

From 0.34% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.34%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Webpack Dev Server

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard38 products
  • arangodb-3.11< 3.11.14.5-r25
  • arangodb-3.12< 3.12.11-r0
  • argo-workflows< 3.6.10-r2
  • argo-workflows-ui-3.7< 3.7.13-r2
  • gitlab-rails-ce-18.1All versions (No fix recorded)
Wolfi12 products
  • argo-workflows< 3.6.10-r2
  • argo-workflows-ui-3.7< 3.7.13-r2
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compatAll versions (No fix recorded)
  • katib-suggestion-hyperband< 0.19.0-r31
Npm1 product
  • webpack-dev-server< 5.2.1
Webpack1 product
Webpack.js1 product

5 vendors · 53 products

References

8 links