GHSA-96qw-h329-v5rg is a high-severity (CVSS 7.5) vulnerability in shakapacker. A fix is available for shakapacker — see the affected versions and patch details below.
Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
shakapackernpmDescription
Summary
Since 2017, the default webpack plugins have passed the entire process.env to EnvironmentPlugin. This pattern exposed ALL build environment variables to client-side JavaScript bundles whenever application code (or any dependency) referenced process.env.VARIABLE_NAME.
This is not a regression - the vulnerable code has existed since the original Webpacker implementation. No recent code change in Shakapacker triggered this issue.
Impact
Any environment variable in the build environment that is referenced in client-side code (including third-party dependencies) is embedded directly into the JavaScript bundle. This includes:
DATABASE_URL- Database credentialsAWS_SECRET_ACCESS_KEY- AWS credentialsRAILS_MASTER_KEY- Rails encrypted credentials keySTRIPE_SECRET_KEY,TWILIO_AUTH_TOKEN- Third-party API keys- Any other secrets present in the build environment
Severity: Critical - secrets are exposed in publicly accessible JavaScript files.
Root Cause
The original code used:
new webpack.EnvironmentPlugin(process.env)
This makes every environment variable available for substitution. If any code references process.env.SECRET_KEY, that value is embedded in the bundle.
Patches
Upgrade to version 9.5.0 or later, which uses an allowlist approach that only exposes NODE_ENV, RAILS_ENV, and WEBPACK_SERVE by default.
Workarounds
If developers cannot upgrade immediately:
- Audit client-side code and dependencies for any
process.env.Xreferences to sensitive variables - Remove sensitive variables from the build environment
- Override the default plugins with a custom webpack/rspack config using an explicit allowlist
Migration
After upgrading, if client-side code needs access to specific environment variables:
Option 1: Use the SHAKAPACKER_PUBLIC_ prefix (recommended)
# Variables with this prefix are automatically exposed
export SHAKAPACKER_PUBLIC_API_URL="https://api.example.com"
Option 2: Use SHAKAPACKER_ENV_VARS
SHAKAPACKER_ENV_VARS=API_URL,FEATURE_FLAG bundle exec rails assets:precompile
Action Required
After upgrading, rotate any secrets that may have been exposed in previously compiled JavaScript bundles.
Resources
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | shakapacker | all versions | 9.5.0npm install shakapacker@9.5.0 |
| 💎RubyGems | shakapacker | all versions | 9.5.0bundle update shakapacker --conservative |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for shakapacker, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update shakapacker to 9.5.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-96qw-h329-v5rg is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-96qw-h329-v5rg can be triaged on real exposure rather than presence alone.
Tailored to GHSA-96qw-h329-v5rg. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-96qw-h329-v5rg in your dependencies?
O3 Security finds GHSA-96qw-h329-v5rg across npm, RubyGems dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.