Loading vulnerability…
Webpack AutoPublicPathRuntimeModule DOM Clobbering XSS
CVE-2024-43788 is a DOM clobbering vulnerability in Webpack's AutoPublicPathRuntimeModule. The generated runtime code can be influenced by attacker-injected, scriptless HTML elements whose name or id attributes collide with DOM properties used by the runtime. This creates a code-reuse gadget that can transform otherwise non-script HTML injection into executable JavaScript, resulting in cross-site scripting in applications that serve affected Webpack-generated bundles.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker may execute arbitrary JavaScript in the security context of a vulnerable application's origin. Depending on the application's privileges and browser protections, this can enable session or token theft, actions as the victim user, modification or exfiltration of accessible application data, and delivery of further client-side payloads.
If you can’t patch tonight, do this now.
No workaround is known. Until fixed bundles can be deployed, prevent untrusted users from injecting HTML and strictly sanitize user-controlled HTML, including name and id attributes, to prevent DOM clobbering. Defense-in-depth controls such as a restrictive Content Security Policy may reduce exploitability but do not replace upgrading.
Patch, then assume compromise.
Upgrade Webpack to version 5.94.0 or later. Rebuild and redeploy affected application bundles so that the fixed AutoPublicPathRuntimeModule runtime code is included. For vendor-packaged products containing Webpack, apply the vendor-provided security update.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.