webpack-dev-server versions up to and including 5.2.3 can serve bundled application source code to a malicious origin when the server runs over plain HTTP. The vulnerability stems from the absence of strict cross-origin controls when the Sec-Fetch-Mode and Sec-Fetch-Site headers are omitted for non-trustworthy origins. An attacker who controls a webpage that developers visit while running the dev server can trigger a script request and read the source code, thereby obtaining full application code leaked from the development environment.

The affected product is webpack-dev-server, specifically versions 5.2.3 and earlier. The advisory recommends upgrading to 5.2.4 or later, which includes the cross-origin resource policy headers to mitigate the exposure.

The CVSS score of 5.3 indicates that the vulnerability has a moderate severity. The EPSS score is reported as less than 1% and it is not listed in KEV, suggesting that widespread exploitation has not yet been observed. The likely attack path requires the developer to be actively running the dev server over HTTP on a predictable host and port, and the attacker to serve a malicious webpage that the developer visits. The absence of the expected request headers removes the necessary origin check, allowing the attacker to read the bundled source. Chromium browsers from version 142 forward mitigate this issue by restricting local network access, reducing the exploitation window for those environments.