| Package | Affected versions | Patched versions |
|---|---|---|
| webpack-dev-server | < 3.1.6 | 3.1.6 |
| webpack-dev-server | < 3.1.11 | 3.1.11 |
Versions of webpack-dev-server before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.
For webpack-dev-server update to version 3.1.11 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free