Skip to content
Fencer Vulns
critical 9.8

CVE-2022-37601 json

Prototype pollution in webpack loader-utils

published 2022-10-12 4 y ago modified 2026-09-10 1 mo ago also GHSA-76p3-8jx3-jpfq , EUVD-2022-7042

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.5%
EPSS 3.5% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known

Summary

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Patch / fix

  • npm loader-utils 1.4.1, 2.0.3
  • webpack.js loader-utils 1.4.1, 2.0.3
  • node-loader-utils Debian 14, Debian 13, Debian 12 2.0.3-1

debian advisories DEBIAN-CVE-2022-37601

  • grafana RHEL 9 9.2.10-7.el9_3
  • grafana RHEL 8 9.2.10-7.el8_9

red hat advisories RHSA-2023:6420RHSA-2023:6972

  • reaper CBL-Mariner 2.0 3.1.1-3

azure linux advisories AZL-26161

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-37601 updated cvss 8.1

loader-utils: prototype pollution in function parseQuery in parseQuery.js

  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-ui-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Developer Tools and Services odo
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8
    affected: no fix available
  • Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana, servicemesh-prometheus, openshift-service-mesh/kiali-rhel8
    affected: no fix planned “Out of support scope”
  • Red Hat Discovery 1 discovery-server-container
    affected: no fix available
  • Red Hat Enterprise Linux 6 firefox Red Hat Enterprise Linux 7 firefox
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 pcs, grafana, pcs-snmp, 389-ds-base, grafana-loki, grafana-mssql, +16 more Red Hat Enterprise Linux 9 pcs, grafana, pcs-snmp, grafana-selinux
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 openshift3/ose-console
    affected: no fix planned “Out of support scope”
show 7 more
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console Red Hat Openshift Data Foundation 4 odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/dashboard-rhel8, devspaces-theia-rhel8-container Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-query-rhel8, rhosdt/jaeger-all-in-one-rhel8
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8 Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin
    affected: no fix available
  • Red Hat Quay 3 quay/quay-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat MTA 6.0 for RHEL 8 mta/mta-ui-rhel8 6.0.1-10
    fixed: vendor fix RHSA-2023:0934
  • Red Hat RHOL 5.6 for RHEL 8 openshift-logging/logging-view-plugin-rhel8 v5.6.0-28
    fixed: vendor fix RHSA-2023:0264
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat MTA 6.0 for RHEL 8 mta/mta-hub-rhel8 6.0.1-8, mta/mta-pathfinder-rhel8 6.0.1-6, mta/mta-admin-addon-rhel8 6.0.1-8, mta/mta-windup-addon-rhel8 6.0.1-9 Red Hat A-MQ Online loader-utils Red Hat build of Apicurio Registry 2 loader-utils Red Hat Data Grid 8 loader-utils Red Hat Decision Manager 7 loader-utils
    +12 more products
    Red Hat Enterprise Linux 8 mozjs60, cockpit-podman Red Hat Enterprise Linux 9 gjs, polkit, polkit-libs Red Hat Fuse 7 loader-utils Red Hat Integration Camel K 1 loader-utils Red Hat JBoss Enterprise Application Platform 6 org.keycloak-keycloak-parent Red Hat JBoss Enterprise Application Platform 7 org.keycloak-keycloak-parent Red Hat JBoss Enterprise Application Platform Expansion Pack org.keycloak-keycloak-parent Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-ingester-rhel8, rhosdt/jaeger-collector-rhel8, rhosdt/jaeger-es-rollover-rhel8, rhosdt/jaeger-es-index-cleaner-rhel8 Red Hat Process Automation 7 loader-utils Red Hat Satellite 6 tfm-rubygem-rabl Red Hat Single Sign-On 7 loader-utils Red Hat RHOL 5.6 for RHEL 8 openshift-logging/vector-rhel8 v0.21.0-46, openshift-logging/fluentd-rhel8 v1.14.6-71, openshift-logging/kibana6-rhel8 v6.8.1-322, openshift-logging/eventrouter-rhel8 v0.4.0-72, openshift-logging/logging-loki-rhel8 v2.7.1-8, openshift-logging/loki-rhel8-operator v5.6.0-53, +11 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

3.50% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm loader-utils
>=2.0.0, <2.0.3
<1.4.1
2.0.3
1.4.1

Classification

Weakness
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.