Critical severity · published Mar 13, 2023
CVE-2023-28154
Webpack 5 before 5.76.0 does not avoid cross-realm object access
9.8
CVSS
1.4%
EPSS
No
On KEV
Description
Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webpack · Webpack.js
5.0.0 before 5.76.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28154
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28154
Patch
https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0
Patch
https://github.com/webpack/webpack/pull/16500
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AU7BOXTBK3KDYSWH67ASZ22TUIOZ3X5G/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PPSAXUTXBCCTAHTCX5BUR4YVP25XALQ3/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2AFCM6FFE3LRYI6KNEQWKMXMQOBZQ2D/
More from Webpack
6.1
CVE-2024-43788
Webpack is a module bundler
3.7
CVE-2025-68157
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects
3.7
CVE-2025-68458
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior