Inclusion of Sensitive Information in Source Code Affecting shakapacker package, versions <9.5.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-SHAKAPACKER-14912582
- published11 Jan 2026
- disclosed8 Jan 2026
- creditUnknown
Introduced: 8 Jan 2026
CVE NOT AVAILABLE CWE-540 (opens in a new tab)How to fix?
Upgrade shakapacker to version 9.5.0 or higher.
Overview
shakapacker is an Use webpack to manage app-like JavaScript modules in Rails
Affected versions of this package are vulnerable to Inclusion of Sensitive Information in Source Code via the EnvironmentPlugin , which exposed all build environment variables. An attacker can access sensitive environment variables, including credentials and API keys, by inspecting client-side JavaScript bundles that have embedded these values.
Workaround
This vulnerability can be mitigated by auditing client-side code and dependencies for any process.env.X references to sensitive variables, removing sensitive variables from the build environment, or overriding the default plugins with a custom webpack/rspack configuration using an explicit allowlist.