VYPR
← All advisories
Critical severityNVD Advisory· Published Oct 12, 2022· Updated Oct 28, 2024

CVE-2022-37601

CVE-2022-37601

Description

Prototype pollution in webpack loader-utils parseQuery function allows attackers to inject properties into Object prototype.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Prototype pollution in webpack loader-utils parseQuery function allows attackers to inject properties into Object prototype.

Vulnerability

Overview

CVE-2022-37601 is a prototype pollution vulnerability in the parseQuery function within parseQuery.js of the popular Node.js library webpack/loader-utils [1]. The flaw arises because the function unsafely handles the name variable, allowing an attacker to inject properties into the global Object.prototype when parsing crafted query strings [1]. Prototype pollution is a common JavaScript vulnerability that can lead to unexpected behavior across an application, potentially affecting any code that relies on the standard object prototype.

Exploitation

Details

To exploit this vulnerability, an attacker must be able to supply a malicious query string to a loader that uses loader-utils's parseQuery function. This typically requires control over input passed into a webpack configuration or a build pipeline, such as via a crafted URL or build argument [2]. No authentication is required per se, but the attacker must have a way to influence the query string processed by the library. The prototype pollution occurs during the parsing of the query string, where the name variable is used to set properties on an object without proper sanitization [1].

Potential

Impact

A successful prototype pollution attack can allow the attacker to set arbitrary properties on the global Object.prototype [1]. This can lead to various downstream security issues, including denial of service (via property overwrites), elevation of privilege in some contexts, and potentially remote code execution if polluted properties are used in security-sensitive operations. The impact is highly dependent on how the application uses the polluted property, but the underlying bug provides a foundational primitive for further exploitation.

Mitigation

Status

The vulnerability affects all versions of webpack/loader-utils prior to 1.4.1 and 2.0.3 [1]. The maintainers have released patched versions that fix the prototype pollution in the parseQuery function. Users are strongly advised to update to version 1.4.1 (for the 1.x branch) or 2.0.3 (for the 2.x branch) to mitigate the risk [1][2]. The fix involves proper sanitization of the parsed query string to prevent pollution of the prototype chain.

References
  1. NVD - CVE-2022-37601
  2. GitHub - webpack/loader-utils: utils for webpack loaders

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
loader-utilsnpm
>= 2.0.0, < 2.0.32.0.3
loader-utilsnpm
< 1.4.11.4.1

Affected products

8

Patches

3
4504e34c4796

fix: security problem (#220)

https://github.com/webpack/loader-utilsAlexander AkaitNov 7, 2022via ghsa
commit
1 file changed · +1 −1
  • lib/parseQuery.js+1 −1 modified
    @@ -26,7 +26,7 @@ function parseQuery(query) {
   }
 
   const queryArgs = query.split(/[,&]/g);
-  const result = {};
+  const result = Object.create(null);
 
   queryArgs.forEach((arg) => {
     const idx = arg.indexOf('=');
a93cf6f47020

fix(security): prototype polution exploit (#217)

https://github.com/webpack/loader-utilsMike CebrianOct 20, 2022via ghsa
commit
1 file changed · +1 −1
  • lib/parseQuery.js+1 −1 modified
    @@ -26,7 +26,7 @@ function parseQuery(query) {
   }
 
   const queryArgs = query.split(/[,&]/g);
-  const result = {};
+  const result = Object.create(null);
 
   queryArgs.forEach((arg) => {
     const idx = arg.indexOf('=');
f4e48a232fae

fix: Resolve potential prototype polution exploit

https://github.com/webpack/loader-utilsMichael CebrianOct 20, 2022via ghsa
commit
1 file changed · +1 −1
  • lib/parseQuery.js+1 −1 modified
    @@ -26,7 +26,7 @@ function parseQuery(query) {
   }
 
   const queryArgs = query.split(/[,&]/g);
-  const result = {};
+  const result = Object.create(null);
 
   queryArgs.forEach((arg) => {
     const idx = arg.indexOf('=');

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

18

News mentions

0

No linked articles in our index yet.