CVE-2025-30360

CVE-2025-30360 affects webpack-dev-server prior to version 5.2.1, allowing source code theft from users accessing malicious websites with non-Chromium browsers. The vulnerability stems from an insufficient Origin header check, specifically allowing IP address Origins, which enables Cross-site WebSocket hijacking. This medium-severity vulnerability (CVSS 6.5) has a network attack vector and low complexity, requiring user interaction but potentially leading to high confidentiality impact. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.