medium 6.4

CVE-2024-43788 json

DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)

published 2024-08-27 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-2497 , GHSA-4vvj-4cpr-p986

cvss: 6.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 61%
public exploits: 0; none known

Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s `AutoPublicPathRuntimeModule`. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue.

Patch / fix

fixed in 2 distros 4 links 1

npm webpack 5.94.0
webpack webpack 5.94.0

debian suse opensuse azure linux

node-webpack Debian 14, Debian 13 5.94.0+dfsg1+~cs11.18.26-2

debian advisories DEBIAN-CVE-2024-43788

pgadmin4 SLE Module for Python 3 15 SP6, openSUSE Leap 15.6 8.5-150600.3.6.1

suse advisories SUSE-SU-2024:3771-1

rollup openSUSE Tumbleweed 3.29.5-1.1
forgejo openSUSE Tumbleweed 8.0.3-1.1

opensuse advisories openSUSE-SU-2025:15020-1 openSUSE-SU-2024:14330-1

python-tensorboard Azure Linux 3.0 2.16.2-3

azure linux advisories AZL-48365

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/webpack/webpack@955e057 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-43788 updated 2026-11-05 cvss 6.1

webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule

Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-view-plugin-rhel9
affected: workaround, no fix available “Fix deferred”
Red Hat Migration Toolkit for Applications 7 mta/mta-ui-rhel9
affected: workaround, no fix planned “Will not fix”
Red Hat Migration Toolkit for Runtimes webpack
affected: workaround, no fix available “Fix deferred”
Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-console-plugin-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8 Red Hat OpenShift Lightspeed lightspeed-console-plugin-rhel9
affected: workaround, no fix available
Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-console-plugin-rhel8
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel7 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8
affected: workaround, no fix planned “Will not fix”
Red Hat Ansible Automation Platform 2 automation-controller, aap-cloud-ui-container
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat build of Apache Camel - HawtIO 4 webpack
affected: workaround, no fix available

show 19 more

Red Hat build of OptaPlanner 8 webpack Red Hat Certification for Red Hat Enterprise Linux 7 redhat-certification Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 6 firefox, thunderbird Red Hat Enterprise Linux 7 thunderbird Red Hat Enterprise Linux 8 js-d3-flame-graph

+3 more productsfewer

Red Hat Enterprise Linux 9 js-d3-flame-graph Red Hat Fuse 7 webpack Red Hat OpenShift AI (RHOAI) odh-dashboard-container

affected: workaround, no fix planned “Will not fix”
Red Hat OpenShift Container Platform 3.11 openshift3/ose-console
affected: workaround, no fix available
Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-monitoring-plugin-rhel9, openshift4/nmstate-console-plugin-rhel9, openshift4/ose-networking-console-plugin-rhel9 Red Hat OpenShift Data Science (RHODS) rhods/odh-dashboard-rhel8 Red Hat OpenShift Dev Spaces devspaces/code-rhel8
affected: workaround, no fix available “Fix deferred”
Red Hat OpenShift distributed tracing 3 rhosdt/jaeger-agent-rhel8
affected: workaround, no fix planned “Will not fix”
Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/console-plugin-rhel8
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin-rhel9
affected: workaround, no fix available
Red Hat Process Automation 7 webpack
affected: workaround, no fix planned “Will not fix”
Red Hat Satellite 6 nodejs-webpack
affected: workaround, no fix available “Fix deferred”
Red Hat Trusted Profile Analyzer rhtpa-trustification-service-rhel9
affected: workaround, no fix available
Red Hat Cryostat 3 on RHEL 8 cryostat-tech-preview/cryostat-rhel8 3.0.1-3, cryostat-tech-preview/cryostat-db-rhel8 3.0.1-3, cryostat-tech-preview/jfr-datasource-rhel8 3.0.1-3, cryostat-tech-preview/cryostat-reports-rhel8 3.0.1-3, cryostat-tech-preview/cryostat-storage-rhel8 3.0.1-3, cryostat-tech-preview/cryostat-rhel8-operator 3.0.1-3, +3 more
fixed: vendor fix RHSA-2024:7706
Red Hat Discovery 1 for RHEL 9 discovery/discovery-ui-rhel9 1.12.0-1, discovery/discovery-server-rhel9 1.12.0-1
fixed: vendor fix RHSA-2025:1249
Red Hat NETOBSERV 1.7 for RHEL 9 network-observability/network-observability-cli-rhel9 v1.7.0-67, network-observability/network-observability-operator-bundle 1.7.0-86, network-observability/network-observability-rhel9-operator v1.7.0-67, network-observability/network-observability-ebpf-agent-rhel9 v1.7.0-67, network-observability/network-observability-console-plugin-rhel9 v1.7.0-67, network-observability/network-observability-flowlogs-pipeline-rhel9 v1.7.0-67
fixed: vendor fix RHSA-2024:8014
Red Hat Data Grid
fixed: vendor fix RHSA-2024:10214
Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 v1.8.5-7
fixed: vendor fix RHSA-2024:10906
Red Hat OpenShift Serverless 1.34 openshift-serverless-1/logic-rhel8-operator 1.34.0-5, openshift-serverless-1/logic-operator-bundle 1.34.0-5, openshift-serverless-1/logic-swf-builder-rhel8 1.34.0-6, openshift-serverless-1/logic-swf-devmode-rhel8 1.34.0-6, openshift-serverless-1/logic-management-console-rhel8 1.34.0-5, openshift-serverless-1/logic-data-index-ephemeral-rhel8 1.34.0-6, +4 more
fixed: vendor fix RHSA-2024:8023
Red Hat RHODF 4.14 for RHEL 9 odf4/odf-console-rhel9 v4.14.13-3
fixed: vendor fix RHSA-2025:0323
Red Hat RHODF 4.16 for RHEL 9 odf4/odf-console-rhel9 v4.16.3-1
fixed: vendor fix RHSA-2024:8113
Red Hat RHODF 4.17 for RHEL 9 odf4/odf-console-rhel9 v4.17.0-53
fixed: vendor fix RHSA-2024:8676
Red Hat RHOSSM 2.4 for RHEL 8 openshift-service-mesh/pilot-rhel8 2.4.11-2, openshift-service-mesh/kiali-rhel8 1.65.16-4, openshift-service-mesh/grafana-rhel8 2.4.11-2, openshift-service-mesh/proxyv2-rhel8 2.4.11-5, openshift-service-mesh/istio-cni-rhel8 2.4.11-2, openshift-service-mesh/ratelimit-rhel8 2.4.11-2, +1 more
fixed: vendor fix RHSA-2024:7724

3 more fixed, 15 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-08-27)

Exploit prediction

0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986 referenced PoC, tagged "exploit" by a source, unverified
research.securitum.com https://research.securitum.com/xss-in-amp4email-dom-clobbering referenced PoC, tagged "exploit" by a source, unverified
scnps.co https://scnps.co/papers/sp23_domclob.pdf referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.4	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
GitHub	3.1	6.4	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
NVD	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	webpack	>=5.0.0-alpha.0, <5.94.0	5.94.0

Affected products

webpack webpack

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61
web, patch
github.com /webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986
web, exploit, vendor-advisory
research.securitum.com /xss-in-amp4email-dom-clobbering
web, exploit, third-party-advisory
scnps.co /papers/sp23_domclob.pdf
web, exploit, mitigation, technical-description, third-party-advisory
github.com /webpack/webpack/issues/18718#issuecomment-2326296270
web
nvd.nist.gov /vuln/detail/CVE-2024-43788
advisory
github.com /webpack/webpack
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary