CVE-2025-68458

CVE-2025-68458 is a policy/allow-list bypass vulnerability affecting Webpack versions 5.49.0 through 5.104.0 when the experiments.buildHttp feature is enabled. An attacker can craft URLs with userinfo to bypass allowedUris restrictions, leading to server-side request forgery (SSRF) and untrusted content inclusion during the build process. With a CVSS score of 3.7 (LOW), exploitation requires low privileges and user interaction, but has high attack complexity, potentially leading to limited confidentiality and integrity impacts. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.