CVE-2020-15262

In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.

• CWE-345
• CWE-345

• https://github.com/waysact/webpack-subresource-integrity/commit/3d7090c08c333fcfb10ad9e2d6cf72e2acb7d87fPatch, Third Party Advisory
• https://github.com/waysact/webpack-subresource-integrity/issues/131Third Party Advisory
• https://github.com/waysact/webpack-subresource-integrity/security/advisories/GHSA-4fc4-chg7-h8ghThird Party Advisory
• https://github.com/waysact/webpack-subresource-integrity/commit/3d7090c08c333fcfb10ad9e2d6cf72e2acb7d87fPatch, Third Party Advisory
• https://github.com/waysact/webpack-subresource-integrity/issues/131Third Party Advisory
• https://github.com/waysact/webpack-subresource-integrity/security/advisories/GHSA-4fc4-chg7-h8ghThird Party Advisory

Published

Oct 19, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15257containerd is an industry-standard container runtime and is …5.2
• CVE-2020-15258In Wire before 3.20.x, `shell.openExternal` was used without…8
• CVE-2020-15259ad-ldap-connector's admin panel before version 5.0.13 does n…8.8
• CVE-2020-1526An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15260PJSIP is a free and open source multimedia communication lib…6.8
• CVE-2020-15261On Windows the Veyon Service before version 4.4.2 contains a…6.7
• CVE-2020-15263In platform before version 9.4.4, inline attributes are not …6.1
• CVE-2020-15264The Boxstarter installer before version 2.13.0 configures C:…7.8
• CVE-2020-15265In Tensorflow before version 2.4.0, an attacker can pass an …7.5
• CVE-2020-15266In Tensorflow before version 2.4.0, when the `boxes` argumen…7.5
• CVE-2020-15269In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired u…9.1
• CVE-2020-1527An elevation of privilege vulnerability exists when the Wind…7.8