Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-pcsalma-upgrade-pcs-snmp | Apr 6, 2023 | Mar 13, 2023 | |
| Centos_linux | — | centos-upgrade-pcscentos-upgrade-pcs-snmp | Apr 6, 2023 | Mar 13, 2023 |
| Debian | debian-upgrade-node-webpack | Jul 30, 2024 | Mar 13, 2023 | |
| Elasticpress Plugin | elasticpress-plugin-cve-2023-28154 | May 15, 2025 | Apr 11, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-pcsoracle-linux-upgrade-pcs-snmp | Apr 5, 2023 | Mar 13, 2023 |
| Redhat_linux | redhat-upgrade-pcsredhat-upgrade-pcs-snmp | Apr 6, 2023 | Mar 13, 2023 | |
| Restricted Site Access Plugin | restricted-site-access-plugin-cve-2023-28154 | May 15, 2025 | Apr 11, 2023 | |
| Rocky_linux | rocky-upgrade-pcsrocky-upgrade-pcs-snmp | Mar 5, 2024 | Mar 13, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub