CVE-2023-28154

Published: Mar 13, 2023Modified: Feb 27, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Affected (1)

Products: Webpack.js: Webpack

Webpack.js

1 product

Webpack

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Webpack.js Webpack	From 5.0.0 to 5.76.0

References (10)

https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0

Source: cve@mitre.org

PatchProduct

https://github.com/webpack/webpack/pull/16500

Source: cve@mitre.org

Patch

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AU7BOXTBK3KDYSWH67ASZ22TUIOZ3X5G/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PPSAXUTXBCCTAHTCX5BUR4YVP25XALQ3/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2AFCM6FFE3LRYI6KNEQWKMXMQOBZQ2D/

Source: cve@mitre.org

https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0