Is loader-utils safe ? 3 known vulnerabilities, worst severity CRITICAL.
// reach 4 direct dependencies
1 carry known advisories, worst HIGH
223 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 89th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-76p3-8jx3-jpfq, the advisory selected below
// 3 advisories GHSA-76p3-8jx3-jpfq Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils prior to version 2.0.3 via the name variable in parseQuery.js. CRIT GHSA-3rfm-jhwj-7488 A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or take a disproportional amount of time to process. This issue has been patched in versions 1.4.2, 2.0.4 and HIGH GHSA-hhq3-ff78-jv3g A regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils via the resourcePath variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or take a disproportional amount of time to process. This issue has been patched in versions 1.4.2, 2.0.4 HIGH Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils prior to version 2.0.3 via the name variable in parseQuery.js.
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High Checked 2026-11-06 at 21:01 UTC. The most recent advisory here was published 2022-10-14. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page