https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:05:01 +0000 https://vulnerability.circl.lu/vuln/ghsa-8fgc-7cc6-rx7x <p><strong>Affected:</strong> npm: webpack</p> <p>### Summary When `experiments.buildHttp` is enabled, webpack’s HTTP(S) resolver (`HttpUriPlugin`) can be bypassed to fetch resources from **hosts outside `allowedUris`** by using crafted URLs that include **userinfo** (`username:password@host`). If `allowedUris` enforcement relies on a **raw string prefix check** (e.g., `uri.startsWith(allowed)`), a URL that *looks* allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a **policy/allow-list bypass** that enables **build-time SSRF behavior** (outbound requests from the build machine to internal-only endpoints, depending on network access) and **untrusted content inclusion** (the fetched response is treated as module source and bundled). In my reproduction, the internal response was also persisted in the buildHttp cache.</p> <p>Reproduced on: - webpack version: **5.104.0** - Node version: **v18.19.1**</p> <p>### Details **Root cause (high level):** `allowedUris` validation can be performed on the raw URI string, while the actual request destination is determined later by parsing the URL (e.g., `new URL(uri)`), which interprets the **authority** as the part after `@`.</p> <p>Example crafted URL: - `http://127.0.0.1:9000@127.0.0.1:9100/secret.js`</p> <p>If the allow-list is `[&#34;http://127.0.0.1:9000&#34;]`, then: - Raw string check: `crafted.startsWith(&#34;http://127.0.0.1:9000&#34;)` → **true** - URL parsing (WHAT `new URL()` will contact): `origin` → `http://127.0.0.1:9100` (hos…</p> <p><strong>Affected:</strong> npm: webpack</p> <p>### Summary When `experiments.buildHttp` is enabled, webpack’s HTTP(S) resolver (`HttpUriPlugin`) can be bypassed to fetch resources from **hosts outside `allowedUris`** by using crafted URLs that include **userinfo** (`username:password@host`). If `allowedUris` enforcement relies on a **raw string prefix check** (e.g., `uri.startsWith(allowed)`), a URL that *looks* allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a **policy/allow-list bypass** that enables **build-time SSRF behavior** (outbound requests from the build machine to internal-only endpoints, depending on network access) and **untrusted content inclusion** (the fetched response is treated as module source and bundled). In my reproduction, the internal response was also persisted in the buildHttp cache.</p> <p>Reproduced on: - webpack version: **5.104.0** - Node version: **v18.19.1**</p> <p>### Details **Root cause (high level):** `allowedUris` validation can be performed on the raw URI string, while the actual request destination is determined later by parsing the URL (e.g., `new URL(uri)`), which interprets the **authority** as the part after `@`.</p> <p>Example crafted URL: - `http://127.0.0.1:9000@127.0.0.1:9100/secret.js`</p> <p>If the allow-list is `[&#34;http://127.0.0.1:9000&#34;]`, then: - Raw string check: `crafted.startsWith(&#34;http://127.0.0.1:9000&#34;)` → **true** - URL parsing (WHAT `new URL()` will contact): `origin` → `http://127.0.0.1:9100` (hos…</p> https://vulnerability.circl.lu/vuln/ghsa-8fgc-7cc6-rx7x