GHSA-96QW-H329-V5RG

Since 2017, the default webpack plugins have passed the entire process.env to EnvironmentPlugin. This pattern exposed ALL build environment variables to client-side JavaScript bundles whenever application code (or any dependency) referenced process.env.VARIABLE_NAME.

This is not a regression - the vulnerable code has existed since the original Webpacker implementation. No recent code change in Shakapacker triggered this issue.

Root Cause

The original code used:

new webpack.EnvironmentPlugin(process.env)

This makes every environment variable available for substitution. If any code references process.env.SECRET_KEY, that value is embedded in the bundle.

Workarounds

If developers cannot upgrade immediately:

1. Audit client-side code and dependencies for any process.env.X references to sensitive variables
2. Remove sensitive variables from the build environment
3. Override the default plugins with a custom webpack/rspack config using an explicit allowlist

Migration

After upgrading, if client-side code needs access to specific environment variables:

Option 1: Use the SHAKAPACKER_PUBLIC_ prefix (recommended)

# Variables with this prefix are automatically exposed
export SHAKAPACKER_PUBLIC_API_URL="https://api.example.com"

Option 2: Use SHAKAPACKER_ENV_VARS

SHAKAPACKER_ENV_VARS=API_URL,FEATURE_FLAG bundle exec rails assets:precompile

Action Required

After upgrading, rotate any secrets that may have been exposed in previously compiled JavaScript bundles.

Resources

• Fix PR: https://github.com/shakacode/shakapacker/pull/857

Any environment variable in the build environment that is referenced in client-side code (including third-party dependencies) is embedded directly into the JavaScript bundle. This includes:

• DATABASE_URL - Database credentials
• AWS_SECRET_ACCESS_KEY - AWS credentials
• RAILS_MASTER_KEY - Rails encrypted credentials key
• STRIPE_SECRET_KEY, TWILIO_AUTH_TOKEN - Third-party API keys
• Any other secrets present in the build environment

Severity: Critical - secrets are exposed in publicly accessible JavaScript files.

GHSA-96QW-H329-V5RG has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (9.5.0); upgrading removes the vulnerable code path.

Kodem intelligence

Upgrade to version 9.5.0 or later, which uses an allowlist approach that only exposes NODE_ENV, RAILS_ENV, and WEBPACK_SERVE by default.

1. What is GHSA-96QW-H329-V5RG? GHSA-96QW-H329-V5RG is a high-severity security vulnerability in shakapacker (npm), affecting versions < 9.5.0. It is fixed in 9.5.0.
2. How severe is GHSA-96QW-H329-V5RG? GHSA-96QW-H329-V5RG has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of shakapacker are affected by GHSA-96QW-H329-V5RG? shakapacker (npm) versions < 9.5.0 is affected.
4. Is there a fix for GHSA-96QW-H329-V5RG? Yes. GHSA-96QW-H329-V5RG is fixed in 9.5.0. Upgrade to this version or later.
5. Is GHSA-96QW-H329-V5RG exploitable, and should I be worried? Whether GHSA-96QW-H329-V5RG is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-96QW-H329-V5RG is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-96QW-H329-V5RG?
   • Upgrade shakapacker to 9.5.0 or later
   • Upgrade shakapacker to 9.5.0 or later