{"id":"CVE-2022-37601","aliases":["AZL-26161","CLSA-2026-1773447386","CLSA-2026-1774830262","CLSA-2026-1774830269","CLSA-2026-1776386119","DEBIAN-CVE-2022-37601","DLA-3258-1","EUVD-2022-7042","GHSA-76p3-8jx3-jpfq","RHSA-2023:6420","RHSA-2023:6972","ROOT-APP-NPM-CVE-2022-37601","UBUNTU-CVE-2022-37601"],"status":"published","title":"Prototype pollution in webpack loader-utils","description":"Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.03503,"percentile":0.89325,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2022-10-12T00:00:00Z","modified":"2026-11-03T08:03:54Z","fixes":[{"ecosystem":"npm","package":"loader-utils","fixed_in":["2.0.3","1.4.1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"loader-utils","fixed_in":["0.2.17-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-loader-utils","fixed_in":["2.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-loader-utils","fixed_in":["2.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-loader-utils","fixed_in":["2.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"node-loader-utils","fixed_in":["1.1.0-2+deb10u1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"loader-utils","fixed_in":["0.2.17-aikido.2","1.2.3-aikido.1","1.2.3-aikido.2","2.0.0-aikido.1","1.2.3-aikido.3","1.4.0-aikido.1","1.4.0-aikido.2","1.4.0-aikido.3","2.0.3-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/loader-utils","fixed_in":["0.2.17-root.io.1","0.2.17-root.io.2","1.2.3-root.io.1","1.2.3-root.io.2","2.0.0-root.io.1","1.2.3-root.io.3","1.4.0-root.io.1","1.4.0-root.io.2","1.4.0-root.io.3","2.0.3-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.17-tuxcare.0"},{"fixed":"0.2.17-tuxcare.1"}]}],"versions":["0.2.17"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.3-tuxcare.0"},{"fixed":"1.2.3-tuxcare.1"}]}],"versions":["1.2.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-tuxcare.0"},{"fixed":"2.0.0-tuxcare.1"}]}],"versions":["2.0.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0-tuxcare.0"},{"fixed":"1.1.0-tuxcare.1"}]}],"versions":["1.1.0"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"node-loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2+deb10u1"}]}],"versions":["1.1.0-2"]},{"source":"osv","ecosystem":"npm","package":"loader-utils","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"loader-utils","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-7.el9_3"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-7.el9_3"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-7.el9_3"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-7.el8_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-7.el8_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-7.el8_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:npm","package":"loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.17-aikido.2"},{"fixed":"1.2.3-aikido.1"},{"fixed":"1.2.3-aikido.2"},{"fixed":"2.0.0-aikido.1"},{"fixed":"1.2.3-aikido.3"},{"fixed":"1.4.0-aikido.1"},{"fixed":"1.4.0-aikido.2"},{"fixed":"1.4.0-aikido.3"},{"fixed":"2.0.3-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.17-root.io.1"},{"fixed":"0.2.17-root.io.2"},{"fixed":"1.2.3-root.io.1"},{"fixed":"1.2.3-root.io.2"},{"fixed":"2.0.0-root.io.1"},{"fixed":"1.2.3-root.io.3"},{"fixed":"1.4.0-root.io.1"},{"fixed":"1.4.0-root.io.2"},{"fixed":"1.4.0-root.io.3"},{"fixed":"2.0.3-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-2","1.2.3-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-1","2.0.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-loader-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.4-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"webpack.js","product":"loader-utils"}],"references":[{"url":"https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L11","tags":["x_transferred","Product","web","report"]},{"url":"https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L47","tags":["x_transferred","Product","web","report"]},{"url":"https://github.com/webpack/loader-utils/issues/212","tags":["x_transferred","Issue Tracking","Third Party Advisory","report","web","article"]},{"url":"https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://dl.acm.org/doi/abs/10.1145/3488932.3497769","tags":["x_transferred","Technical Description","web"]},{"url":"https://dl.acm.org/doi/pdf/10.1145/3488932.3497769","tags":["x_transferred","Technical Description","web"]},{"url":"http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf","tags":["x_transferred","Technical Description","web"]},{"url":"https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00044.html","tags":["mailing-list","x_transferred","Third Party Advisory","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37601","tags":["web","advisory"]},{"url":"https://github.com/webpack/loader-utils/releases/tag/v2.0.3","tags":["web"]},{"url":"https://github.com/webpack/loader-utils/pull/217","tags":["web"]},{"url":"https://github.com/webpack/loader-utils/pull/220","tags":["web"]},{"url":"https://github.com/webpack/loader-utils/releases/tag/v1.4.1","tags":["web"]},{"url":"https://github.com/webpack/loader-utils/commit/f4e48a232fae900237c3e5ff7b57ce9e1c734de1","tags":["web"]},{"url":"https://github.com/webpack/loader-utils/commit/4504e34c4796a5836ef70458327351675aed48a5","tags":["web"]},{"url":"https://github.com/webpack/loader-utils/commit/a93cf6f4702012030f6b5ee8340d5c95ec1c7d4c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-76p3-8jx3-jpfq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37601.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-37601","tags":["advisory"]},{"url":"https://github.com/webpack/loader-utils","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6420","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2131146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2131147","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2131148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2138014","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2138015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2148252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2161274","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184483","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2188193","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2193018","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6420.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23552","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23552","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23552","tags":["advisory"]},{"url":"https://grafana.com/blog/2023/01/25/grafana-security-releases-new-versions-with-fixes-for-cve-2022-23552-cve-2022-41912-and-cve-2022-39324/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-31123","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31123","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31123","tags":["advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-31130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31130","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-37601","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-37601","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-39201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39201","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39201","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-39306","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39306","tags":["advisory"]},{"url":"https://grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-39307","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39307","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39307","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-39324","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39324","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39324","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41717","tags":["advisory"]},{"url":"https://go.dev/cl/455635","tags":["article"]},{"url":"https://go.dev/cl/455717","tags":["article"]},{"url":"https://go.dev/issue/56350","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2022-1144","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3128","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213626","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3128","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3128","tags":["advisory"]},{"url":"https://grafana.com/blog/2023/06/22/grafana-security-release-for-cve-2023-3128/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24534","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24534","tags":["advisory"]},{"url":"https://go.dev/issue/58975","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6972","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2193250","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224606","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6972.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-37601","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-37601","description":"Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.","status":"published","published":"2022-10-12T00:00:00Z","modified":"2024-10-28T19:41:38.297Z","updated_at":"2026-11-02T14:34:26.977054Z"}],"euvd":[{"id":"EUVD-2022-7042","description":"Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.","status":"published","published":"2022-10-12T00:00:00Z","modified":"2024-10-28T19:41:38Z","updated_at":"2026-11-03T00:05:15.649433Z"}],"ghsa":[{"id":"GHSA-76p3-8jx3-jpfq","title":"Prototype pollution in webpack loader-utils","description":"Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils prior to version 2.0.3 via the name variable in parseQuery.js.","status":"published","published":"2022-10-13T12:00:28Z","modified":"2023-09-21T22:15:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:37:06.234371Z"}],"nvd":[{"id":"CVE-2022-37601","description":"Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.","status":"published","published":"2022-10-12T20:15:11.263Z","modified":"2026-06-17T04:55:08.44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:07:29.52424Z"}],"osv":[{"id":"AZL-26161","title":"CVE-2022-37601 affecting package reaper for versions less than 3.1.1-3","description":"Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.","status":"published","published":"2022-10-12T20:15:11Z","modified":"2026-04-21T04:23:30.989304Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"DEBIAN-CVE-2022-37601","description":"Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.","status":"published","published":"2022-10-12T20:15:11.263Z","modified":"2026-11-03T08:03:54.439890612Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:23:34.488036Z"},{"id":"GHSA-76p3-8jx3-jpfq","title":"Prototype pollution in webpack loader-utils","description":"Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils prior to version 2.0.3 via the name variable in parseQuery.js.","status":"published","published":"2022-10-13T12:00:28Z","modified":"2026-09-10T03:49:46.237604968Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"RHSA-2023:6420","title":"Red Hat Security Advisory: grafana security and enhancement update","status":"published","published":"2024-09-30T14:58:38Z","modified":"2026-10-16T10:02:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:6972","title":"Red Hat Security Advisory: grafana security and enhancement update","status":"published","published":"2024-09-16T12:06:30Z","modified":"2026-10-13T10:05:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"UBUNTU-CVE-2022-37601","description":"Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.","status":"published","published":"2022-10-12T20:15:00Z","modified":"2026-10-17T12:55:58.986263677Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"CLSA-2026-1773447386","title":"TuxCare security update for loader-utils (1 CVE)","description":"TuxCare rebuilt loader-utils to address 1 CVE. Fixed in 0.2.17-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.64952706Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774830262","title":"TuxCare security update for loader-utils (3 CVEs)","description":"TuxCare rebuilt loader-utils to address 3 CVEs. Fixed in 1.2.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-15T09:47:48.474997272Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774830269","title":"TuxCare security update for loader-utils (3 CVEs)","description":"TuxCare rebuilt loader-utils to address 3 CVEs. Fixed in 2.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-15T09:47:48.444492912Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776386119","title":"TuxCare security update for loader-utils (3 CVEs)","description":"TuxCare rebuilt loader-utils to address 3 CVEs. Fixed in 1.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:26Z","modified":"2026-10-15T09:47:07.626290769Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CVE-2022-37601","description":"Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.","status":"published","published":"2022-10-12T00:00:00Z","modified":"2026-10-28T02:30:53.958690281Z","updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"DLA-3258-1","title":"node-loader-utils - security update","status":"published","published":"2022-12-31T00:00:00Z","modified":"2026-03-09T01:18:03.573313Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"ROOT-APP-NPM-CVE-2022-37601","title":"CVE-2022-37601 in loader-utils - Patched by Root","description":"Root has patched CVE-2022-37601 in the loader-utils package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-02T15:55:23Z","modified":"2026-09-02T18:15:03.768388462Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}