CVE-2020-15262

—

CVSS 3.1

3.7 low

EPSS

<1%p43

Published

Oct 19, 2020 (Oct 19, 2020)

Modified

Jun 17, 2026

Description

In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.

Vendors: webpack-subresource-integrity project
Products: webpack-subresource-integrity
Weakness: CWE-345
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.