CVE-2023-28154: Critical severity webpack vulnerability
Published Mar 13, 2023
·Updated
Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
Affected Software
3 affected componentsFixes available
npm/webpack>=5.0.0<5.76.0
5.76.0
redhat/webpack<5.76.0
5.76.0
webpack.js Webpack Node.js>=5.0.0<5.76.0
Remediation
Patch Available
Patch Available
Event History
Mar 13, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Advisory Published
03:30 AM
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-28154.
2
What is the severity of CVE-2023-28154?
CVE-2023-28154 has a severity rating of 9.8 (Critical).
3
What is the affected software?
The affected software is Webpack 5 before version 5.76.0.
4
How does CVE-2023-28154 occur?
CVE-2023-28154 occurs due to Webpack 5 before 5.76.0 not avoiding cross-realm object access and mishandling the magic comment feature, allowing an attacker to obtain access to the real global object.
5
How can I fix CVE-2023-28154?
To fix CVE-2023-28154, you should update Webpack to version 5.76.0 or later.