Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcs-snmpUpgrade pcs | Apr 6, 2023 | Mar 13, 2023 |
| Centos_linux | — | Upgrade pcs-snmpUpgrade pcs | Apr 6, 2023 | Mar 13, 2023 |
| Debian | — | Upgrade node-webpack | Jul 30, 2024 | Mar 13, 2023 |
| Elasticpress Plugin | — | Update elasticpress plugin to version 4.5.1, or a newer patched version | May 15, 2025 | Apr 11, 2023 |
| Oracle_linux | — | Upgrade pcsUpgrade pcs-snmp | Apr 5, 2023 | Mar 13, 2023 |
| Redhat_linux | — | Upgrade pcs-snmpUpgrade pcs | Apr 6, 2023 | Mar 13, 2023 |
| Restricted Site Access Plugin | — | Update restricted-site-access plugin to version 7.4.0, or a newer patched version | May 15, 2025 | Apr 11, 2023 |
| Rocky_linux | — | Upgrade pcs-snmpUpgrade pcs | Mar 5, 2024 | Mar 13, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub