CVE-2022-37601

Deeper analysis

CVE-2022-37601 is a prototype pollution vulnerability in the parseQuery function within parseQuery.js of the webpack loader-utils package. The flaw occurs via the name variable and affects all versions prior to 1.4.1 and 2.0.3. It is tracked under CWE-1321 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction.

An attacker able to supply crafted input to the parseQuery function can pollute JavaScript object prototypes in applications or build processes that depend on the vulnerable loader-utils versions. Successful exploitation can lead to arbitrary manipulation of object properties, resulting in impacts to confidentiality, integrity, and availability within the affected webpack-based environment.

The package maintainers addressed the issue by releasing fixed versions 1.4.1 and 2.0.3. The provided references include source code links to the affected parseQuery.js implementation along with academic papers examining JavaScript prototype pollution patterns, but contain no additional mitigation guidance beyond the version updates. The associated EPSS score has remained in a narrow band near 0.19 with no pronounced post-disclosure increase.